URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Submission: On October 30 via api from US

Summary

This website contacted 61 IPs in 10 countries across 45 domains to perform 239 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 35.173.160.135 14618 (AMAZON-AES)
7 99.86.2.127 16509 (AMAZON-02)
7 2606:4700:e0:... 13335 (CLOUDFLAR...)
1 9 2a00:1450:400... 15169 (GOOGLE)
8 2600:9000:20d... 16509 (AMAZON-02)
10 2600:9000:20d... 16509 (AMAZON-02)
1 10 2a00:1450:400... 15169 (GOOGLE)
5 172.217.21.226 15169 (GOOGLE)
3 65.9.24.128 16509 (AMAZON-02)
1 13 151.101.14.137 54113 (FASTLY)
3 151.101.114.137 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
4 69.173.144.143 26667 (RUBICONPR...)
1 7 104.111.215.135 16625 (AKAMAI-AS)
3 185.64.189.112 62713 (AS-PUBMATIC)
3 5 216.52.2.30 30282 (AS-INAPCD...)
2 6 185.33.220.244 29990 (ASN-APPNEX)
1 52.29.134.97 16509 (AMAZON-02)
1 134.209.129.254 14061 (DIGITALOC...)
10 15 2606:2800:233... 15133 (EDGECAST)
2 8 35.244.159.8 15169 (GOOGLE)
5 136.144.59.88 54825 (PACKET)
1 52.210.177.43 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
14 18.221.6.219 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 3 2620:116:800d... 16509 (AMAZON-02)
1 151.101.112.157 54113 (FASTLY)
1 2600:9000:20d... 16509 (AMAZON-02)
1 104.244.42.133 13414 (TWITTER)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 64.140.160.2 18450 (WEBNX)
1 104.244.42.131 13414 (TWITTER)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2620:1ec:21::14 8068 (MICROSOFT...)
1 199.232.53.140 54113 (FASTLY)
1 3.120.64.232 16509 (AMAZON-02)
13 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
23 2800:3f0:4001... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 104.111.215.68 16625 (AKAMAI-AS)
3 104.111.215.51 16625 (AKAMAI-AS)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 2 151.101.114.49 54113 (FASTLY)
4 8 52.59.102.119 16509 (AMAZON-02)
2 18.156.0.31 16509 (AMAZON-02)
2 3 52.18.161.147 16509 (AMAZON-02)
1 1 172.217.22.66 15169 (GOOGLE)
1 2 18.157.239.120 16509 (AMAZON-02)
1 2620:1ec:bdf::10 8068 (MICROSOFT...)
1 104.111.230.142 16625 (AKAMAI-AS)
1 1 206.189.254.17 14061 (DIGITALOC...)
1 205.185.216.10 20446 (HIGHWINDS3)
1 37.157.6.252 198622 (ADFORM)
1 2a02:fa8:8806... 41041 (VCLK-EU-)
1 1 185.86.139.104 201081 (SMARTADSE...)
239 61
Apex Domain
Subdomains
Transfer
34 threatpost.com
threatpost.com
assets.threatpost.com
media.threatpost.com
798 KB
30 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
vid.connatix.com
img.connatix.com
1 MB
26 gstatic.com
www.gstatic.com
fonts.gstatic.com
csi.gstatic.com
158 KB
24 advertising.com
adserver-us.adtech.advertising.com
ads.adaptv.advertising.com
pixel.advertising.com
12 KB
19 googlesyndication.com
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
124 KB
12 google.com
www.google.com
adservice.google.com
3 KB
9 adnxs.com
ib.adnxs.com
acdn.adnxs.com
5 KB
9 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
142 KB
8 googleapis.com
fonts.googleapis.com
imasdk.googleapis.com
110 KB
8 openx.net
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
1 KB
7 admetricspro.com
qd.admetricspro.com
291 KB
7 adlightning.com
tagan.adlightning.com
158 KB
6 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
233 B
5 ampproject.org
cdn.ampproject.org
106 KB
5 a-mo.net
prebid.a-mo.net
1 KB
5 lijit.com
ap.lijit.com
2 KB
5 rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
7 KB
4 casalemedia.com
htlb.casalemedia.com
as-sec.casalemedia.com
ssum.casalemedia.com
1 KB
3 adsrvr.org
match.adsrvr.org
1 KB
3 yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
3 KB
3 indexww.com
js-sec.indexww.com
3 2mdn.net
s0.2mdn.net
gcdn.2mdn.net
r4---sn-4g5ednse.c.2mdn.net
2 MB
3 quantserve.com
secure.quantserve.com
pixel.quantserve.com
9 KB
3 google-analytics.com
www.google-analytics.com
19 KB
3 3lift.com
tlx.3lift.com
eb2.3lift.com
786 B
3 amazon-adsystem.com
c.amazon-adsystem.com
33 KB
3 googletagservices.com
www.googletagservices.com
74 KB
2 everesttech.net
sync-tm.everesttech.net
650 B
2 google.de
www.google.de
adservice.google.de
422 B
2 servenobid.com
ads.servenobid.com
public.servenobid.com
475 B
2 serverbid.com
e.serverbid.com
sync.serverbid.com
267 B
1 smartadserver.com
ssbsync-global.smartadserver.com
355 B
1 dotomi.com
aol-match.dotomi.com
104 B
1 adform.net
c1.adform.net
187 B
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 reddit.com
www.reddit.com
1 KB
1 linkedin.com
www.linkedin.com
1 facebook.com
graph.facebook.com
584 B
1 twitter.com
analytics.twitter.com
652 B
1 ipify.org
geo.ipify.org
1 KB
1 t.co
t.co
448 B
1 quantcount.com
rules.quantcount.com
358 B
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 googletagmanager.com
www.googletagmanager.com
49 KB
1 kasperskycontenthub.com
kasperskycontenthub.com
399 B
239 45
Domain Requested by
23 csi.gstatic.com imasdk.googleapis.com
16 threatpost.com threatpost.com
15 adserver-us.adtech.advertising.com 10 redirects threatpost.com
14 capi.connatix.com cd.connatix.com
13 tpc.googlesyndication.com tagan.adlightning.com
threatpost.com
cdn.ampproject.org
10 www.google.com 1 redirects threatpost.com
tagan.adlightning.com
10 media.threatpost.com threatpost.com
9 vid.connatix.com cd.connatix.com
8 pixel.advertising.com 4 redirects
8 assets.threatpost.com threatpost.com
assets.threatpost.com
7 qd.admetricspro.com threatpost.com
qd.admetricspro.com
7 tagan.adlightning.com threatpost.com
tagan.adlightning.com
6 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
6 ib.adnxs.com 2 redirects qd.admetricspro.com
cds.connatix.com
5 cdn.ampproject.org threatpost.com
5 prebid.a-mo.net qd.admetricspro.com
5 ap.lijit.com 3 redirects qd.admetricspro.com
5 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
threatpost.com
4 u.openx.net 2 redirects cds.connatix.com
4 fastlane.rubiconproject.com qd.admetricspro.com
3 match.adsrvr.org 2 redirects
3 acdn.adnxs.com cds.connatix.com
qd.admetricspro.com
3 ads.pubmatic.com cds.connatix.com
qd.admetricspro.com
3 js-sec.indexww.com cds.connatix.com
qd.admetricspro.com
3 pagead2.googlesyndication.com securepubads.g.doubleclick.net
3 img.connatix.com threatpost.com
3 9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com tagan.adlightning.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
threatpost.com
3 teachingaids-d.openx.net qd.admetricspro.com
cds.connatix.com
3 hbopenbid.pubmatic.com qd.admetricspro.com
cds.connatix.com
3 cds.connatix.com threatpost.com
tagan.adlightning.com
cd.connatix.com
3 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
3 www.googletagservices.com threatpost.com
tagan.adlightning.com
securepubads.g.doubleclick.net
2 eb2.3lift.com 1 redirects qd.admetricspro.com
2 cm.g.doubleclick.net 2 redirects
2 ups.analytics.yahoo.com
2 sync-tm.everesttech.net 2 redirects
2 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com threatpost.com
2 as-sec.casalemedia.com cds.connatix.com
2 adservice.google.com tagan.adlightning.com
imasdk.googleapis.com
2 pixel.quantserve.com 1 redirects threatpost.com
1 ssbsync-global.smartadserver.com 1 redirects
1 aol-match.dotomi.com
1 c1.adform.net
1 ssum.casalemedia.com 1 redirects
1 eu-u.openx.net qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 eus.rubiconproject.com qd.admetricspro.com
1 public.servenobid.com qd.admetricspro.com
1 pr-bh.ybp.yahoo.com
1 r4---sn-4g5ednse.c.2mdn.net
1 gcdn.2mdn.net 1 redirects
1 googleads.g.doubleclick.net threatpost.com
1 s0.2mdn.net imasdk.googleapis.com
1 ads.adaptv.advertising.com cds.connatix.com
1 www.reddit.com threatpost.com
1 www.linkedin.com threatpost.com
1 graph.facebook.com threatpost.com
1 analytics.twitter.com tagan.adlightning.com
1 geo.ipify.org qd.admetricspro.com
1 adservice.google.de tagan.adlightning.com
1 www.google.de threatpost.com
1 stats.g.doubleclick.net www.google-analytics.com
1 t.co threatpost.com
1 rules.quantcount.com secure.quantserve.com
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 www.gstatic.com www.google.com
1 ads.servenobid.com qd.admetricspro.com
1 e.serverbid.com qd.admetricspro.com
1 tlx.3lift.com qd.admetricspro.com
1 htlb.casalemedia.com qd.admetricspro.com
1 www.googletagmanager.com threatpost.com
1 kasperskycontenthub.com threatpost.com
1 cd.connatix.com 1 redirects
239 77
Subject Issuer Validity Valid
threatpost.com
DigiCert SHA2 Secure Server CA
2020-06-10 -
2021-06-15
a year crt.sh
*.adlightning.com
Amazon
2020-07-22 -
2021-08-22
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-10 -
2021-08-10
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
assets.threatpost.com
Amazon
2020-03-04 -
2021-04-04
a year crt.sh
media.threatpost.com
Amazon
2020-03-04 -
2021-04-04
a year crt.sh
www.google.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.google.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
c.amazon-adsystem.com
Amazon
2020-08-04 -
2021-08-02
a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2
2020-09-29 -
2021-10-19
a year crt.sh
kasperskycontenthub.com
DigiCert SHA2 Secure Server CA
2020-06-01 -
2021-06-09
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA
2019-01-10 -
2021-01-14
2 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2020-03-02 -
2021-04-01
a year crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA
2019-02-22 -
2021-02-21
2 years crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2
2020-03-11 -
2021-05-10
a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.3lift.com
Amazon
2020-07-04 -
2021-08-05
a year crt.sh
e.serverbid.com
Let's Encrypt Authority X3
2020-09-18 -
2020-12-17
3 months crt.sh
*.adtech.advertising.com
DigiCert SHA2 Secure Server CA
2020-04-16 -
2022-04-21
2 years crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
*.a-mo.net
Let's Encrypt Authority X3
2020-10-07 -
2021-01-05
3 months crt.sh
*.servenobid.com
Amazon
2020-03-12 -
2021-04-12
a year crt.sh
*.gstatic.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA
2020-10-02 -
2021-10-07
a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2020-08-14 -
2021-08-19
a year crt.sh
t.co
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
www.google.de
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.ipify.org
COMODO RSA Domain Validation Secure Server CA
2018-01-24 -
2021-01-23
3 years crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-09-11 -
2020-12-10
3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2020-10-02 -
2021-04-02
6 months crt.sh
*.reddit.com
DigiCert SHA2 Secure Server CA
2020-08-26 -
2021-02-22
6 months crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-07-29 -
2021-01-25
6 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
misc-sni.google.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.doubleclick.net
GTS CA 1O1
2020-10-06 -
2020-12-29
3 months crt.sh
*.c.docs.google.com
GTS CA 1O1
2020-10-20 -
2020-12-29
2 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018
2020-01-02 -
2021-04-02
a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-06-02 -
2020-11-29
6 months crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA
2020-10-24 -
2021-04-20
6 months crt.sh
pixel.advertising.com
DigiCert SHA2 High Assurance Server CA
2020-10-04 -
2021-03-31
6 months crt.sh
public.servenobid.com
DigiCert SHA2 Secure Server CA
2020-08-26 -
2021-08-25
a year crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert SHA2 Secure Server CA
2020-03-11 -
2021-04-14
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA
2019-09-16 -
2021-09-20
2 years crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-06-19 -
2021-08-31
2 years crt.sh

This page contains 33 frames:

Primary Page: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Frame ID: F08DFD57C25B9BBF2E565E86C1C34583
Requests: 112 HTTP requests in this frame

Frame: https://cds.connatix.com/p/71742/connatix.player.dc.js
Frame ID: D0062BE154D1D7DC9F9B2F767B612D3D
Requests: 61 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=71z45ns2u349
Frame ID: 0B3CB454EA14B0AAF0D324DCCDF5C4C7
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=rq0vmhk7g2va
Frame ID: 06DF87AF1456353215DF390297B3825B
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=cnkvxnktakif
Frame ID: 592391E7AA691C9FBBB523826A4DE8EB
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=f5bx4wkt2fie
Frame ID: F3C43251B41134FAB29937BA8C2A4EE2
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-22b14432.js
Frame ID: 842789D40FCC83A3BC05BD40E083CA90
Requests: 24 HTTP requests in this frame

Frame: https://9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 522BA72003E5DBF79413F786D8DBD9A1
Requests: 1 HTTP requests in this frame

Frame: https://9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: E1D1C2D4CE7B383D9BEE14F05B4C0EE6
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-22b14432.js
Frame ID: E622923143F3CBE1A1DAD16E2B84E94B
Requests: 10 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Frame ID: 790216796F00AA0C4D5047EC19FA8065
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: 5A5657834DD591D144731928C5FF11EA
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Frame ID: 62FED3A428920E15DB4E39D8708860C8
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Frame ID: B6C28DCEF4A7B8A96D558ACE9DF8FB44
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Frame ID: 570B84A6AB7C637C3DF8E82E862F9053
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Frame ID: 8430159A04F8611907FEDD8D42CE6D82
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 6D07361D80014E8FD2057C23005F63AE
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: FBB2F960DD1C966213D6286CF7341356
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 7A41F6252E80EBBCFD7A1C7736027542
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: 64756EA43F2ECECAF926E8E5EC3F534A
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: B5A0BF5489E31EF4E2E89C0F5E5404F5
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: 023350D6BC0C1C000BE86B5A6C522AE5
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FCA05436EC182C7B61F19CB9B2B2546E
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: E378FE4EA92CE059291F867A1F6E4775
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: FE11B3C3D726F68588824C75E38ADC76
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: ADC1CF225284C04C5DBF0E194DBDE31E
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 35F7866C4229052307BE5FCFAF2347C3
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: CD6B82131F7C0DB3A2060CBA69CE0DD8
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 1FE5043CCA6DA9C990D57AB119AB8798
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: EE51355E200052ACE2E43FEB8464310D
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 83B9A7D52D700677AEBB8B6ADBE4AF37
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Frame ID: 97B4A4BFCE9E349EB6151FFA1CE7CF80
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 5FCEA738849733E89D89C552122D172A
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

239
Requests

99 %
HTTPS

45 %
IPv6

45
Domains

77
Subdomains

61
IPs

10
Countries

5299 kB
Transfer

9439 kB
Size

8
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/71742/connatix.player.dc.js
Request Chain 46
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1Aa1015a3a-1a8f-11eb-ae02-12724de64e5e;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623
Request Chain 47
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1Aa1013d34-1a8f-11eb-a362-12d2f833f2cc;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623
Request Chain 48
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623
Request Chain 49
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1Aa100f1bc-1a8f-11eb-9032-1248c7260bf4;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623
Request Chain 50
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1Aa10153a0-1a8f-11eb-a710-12052abf3156;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624
Request Chain 156
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 176
  • https://gcdn.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/9F2772E36B2359034F17EA3B25B43453DD9CB307.A081C33D4F8957D8DE9DBDDFA2AC69A499D1E546/key/ck2/file/file.mp4?cpn=Zeiu4IHc81iWLy9T HTTP 302
  • https://r4---sn-4g5ednse.c.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/154560E7251D92661BEAA3007CCD52AA37637B19.763531DD1A981077E82E3F5BC865B701C5744A45/key/cms1/cms_redirect/yes/mh/7w/mip/2a01:4f8:121:131a::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1604048908/mv/m/mvi/4/pl/42?cpn=Zeiu4IHc81iWLy9T&file=file.mp4
Request Chain 204
  • https://u.openx.net/w/1.0/pd HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1
Request Chain 206
  • https://u.openx.net/w/1.0/pd HTTP 302
  • https://u.openx.net/w/1.0/pd?cc=1
Request Chain 210
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&apid=UPa3743796-1a8f-11eb-9e9e-020b4f9b4944
Request Chain 211
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://pixel.advertising.com/ups/55953/sync?uid=7162485d-ca74-42b6-9eb5-544fed20a4db&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=7162485d-ca74-42b6-9eb5-544fed20a4db
Request Chain 212
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1 HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&apid=UPa391f82a-1a8f-11eb-89ae-0225ad2058c0
Request Chain 215
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 220
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Request Chain 221
  • https://ap.lijit.com/beacon?informer=13394437 HTTP 302
  • https://ap.lijit.com/beacon?informer=13394437&dnr=1
Request Chain 224
  • https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=index_rtb&uid=X5vYUnq1gythG0wadm3aTAAA%261177
Request Chain 225
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true HTTP 307
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=sovrn&uid=defffb5f9ca5f4c360e194d3
Request Chain 227
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUFhMTAxMGRiNC0xYThmLTExZWItYmIzZi0xMjc0YzFmZTViZjY%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
  • https://pixel.advertising.com/ups/55946/sync?uid=CAESEJiORCawQcNHaEaA5VLHFv4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
Request Chain 229
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=appnexus&uid=5547137768173640945
Request Chain 231
  • https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=false&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dsmartadserver%26uid%3D%5Bssb_sync_pid%5D HTTP 302
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=smartadserver&uid=2222315949382742527
Request Chain 232
  • https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
  • https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=dTgqjCRmJtxtOnbWdzg-3HJrct9taiuLdDz-s75D

239 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
threatpost.com/russian-espionage-custom-malware/160673/
81 KB
21 KB
Document
General
Full URL
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
517bca3d715aa94d9cb53024c0b2f5142ff43bc84b6444c703d7266f28766846
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
threatpost.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Fri, 30 Oct 2020 09:09:33 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/160673>; rel="alternate"; type="application/json" <https://threatpost.com/?p=160673>; rel=shortlink
X-Frame-Options
SAMEORIGIN
X-Debug-Auth
off
X-Request-Host
threatpost.com
x-cache-hit
HIT
Content-Encoding
gzip
main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/
253 KB
39 KB
Stylesheet
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:09 GMT
Server
nginx
ETag
W/"5f96a83d-3f2b8"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:34 GMT
op.js
tagan.adlightning.com/math-aids-threatpost/
37 KB
14 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2424c11ee5a708cfe8778891fbe7d95729e12d8a27b404851d099d7bde799563

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
J7oZialg0KBAXl9q8d0kAE0R5Q5WfeDo
content-encoding
gzip
etag
"60ac00b6a0e474c450f8c809beaf5beb"
age
1931
x-cache
Hit from cloudfront
status
200
content-length
13416
x-amz-meta-git_commit
9a4f7ce
last-modified
Thu, 29 Oct 2020 19:35:20 GMT
server
AmazonS3
date
Fri, 30 Oct 2020 08:37:31 GMT
content-type
application/javascript
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
x-amz-cf-id
RU9TwUBYDUqe0TDIdoVWivUHtKGxvxrSZJ2NaOPCD81U7LlLoJChrA==
ros-layout.js
qd.admetricspro.com/js/threatpost/
22 KB
3 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
116
status
200
cf-request-id
061a5e07dd00002bd6b8b09000000001
last-modified
Thu, 06 Aug 2020 02:14:13 GMT
server
cloudflare
etag
W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VP5wls3V7YclwagexhxNx2%2FS4txXWYe1wSMmv07M5o05xu9Tr5qc93nz57ht4ZzFEPtGQX3yJ8YpDdYt%2Ff9Xufsm7Nr%2B%2FGyB94%2F3BSts%2Fcaf0WyqDGsh83OCFY431e66"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b792bd6-FRA
expires
Fri, 30 Oct 2020 09:17:01 GMT
gpt.js
www.googletagservices.com/tag/js/
52 KB
18 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c918c3596295070bd9409d3167161fa8ad072a46512875abf68088fb29d23fa7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"678 / 108 of 1000 / last-modified: 1604009522"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
17730
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:33 GMT
cmp.js
qd.admetricspro.com/js/threatpost/
305 KB
82 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
117
status
200
cf-request-id
061a5e07db00002bd6d0ad5000000001
last-modified
Tue, 06 Oct 2020 19:53:29 GMT
server
cloudflare
etag
W/"4c426-5b105f3f297c7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=E3P%2FOUvh82uqUC5oW46auw5K%2BCw6k8vCWfKYMvNkhvFMfYhbD%2Fc3AdAs303CmifySYBDHN58%2BmprisApR7BcnBUPXJiyDSYF6RXZgK%2FWxFzltfooWCsFzZag3jHWy%2BEP"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b7b2bd6-FRA
expires
Fri, 30 Oct 2020 09:17:01 GMT
uspcmp.js
qd.admetricspro.com/js/threatpost/
148 KB
55 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
117
status
200
cf-request-id
061a5e07db00002bd6eb186000000001
last-modified
Sat, 08 Aug 2020 22:40:07 GMT
server
cloudflare
etag
W/"24e50-5ac65673cef1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WI2XkV0ANKaYRt%2B9dUC8ihwVp4Pt6w66liXfdhbhvlKvW6hNN2X%2B7jp%2FfNMkc28KbpsqDMsmVOCoSBnDsT3RY96KotCeyW5raQSnI0eaSyZ77qSK42xPPFz0XzrBzgHU"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b7c2bd6-FRA
expires
Fri, 30 Oct 2020 09:17:00 GMT
targeting.js
qd.admetricspro.com/js/threatpost/
275 B
804 B
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
116
status
200
cf-request-id
061a5e07db00002bd6dcb08000000001
last-modified
Sat, 08 Feb 2020 20:49:18 GMT
server
cloudflare
etag
W/"113-59e16a3cfb471-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0Bb5tut27zue1%2FN0Z7XZ%2B1dKYc1uR80F4veKS7euxQVAbz93hFus2HbQlCSO8G67PRLSHj4Dfv%2BkybaTXxDrxBuBXIootzQttP4yEeZ8hqxNloO1xLCj1%2BGN4N8E29PU"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b7d2bd6-FRA
expires
Fri, 30 Oct 2020 09:15:47 GMT
prebid.js
qd.admetricspro.com/js/threatpost/
399 KB
114 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
117
status
200
cf-request-id
061a5e07db00002bd6f2130000000001
last-modified
Fri, 02 Oct 2020 04:32:28 GMT
server
cloudflare
etag
W/"63c0e-5b0a89ec6a525-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VBvSx3xDxFLmKVlFQBwI%2F8pJkoVTXP6EgINpD3ED%2BsGUSEy%2BhLzWN%2BExuRVyRodzxxfbCU1MmIpP2RDKyywC5NOSNQn1MPU%2Be2llmWi6f5OCGoIEhi84NrI%2F%2FSx8EFwV"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b7e2bd6-FRA
expires
Fri, 30 Oct 2020 09:15:47 GMT
engine.js
qd.admetricspro.com/js/threatpost/
28 KB
8 KB
Script
General
Full URL
https://qd.admetricspro.com/js/threatpost/engine.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
116
status
200
cf-request-id
061a5e07dc00002bd606241000000001
last-modified
Fri, 09 Oct 2020 03:25:52 GMT
server
cloudflare
etag
W/"6e56-5b1348179d4a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Pk43RxL%2FjLRSLxNLTS69TT14Ttuz09aOXl0i2gKpJj4xZpPwkpibWwS3EPxYg7hWuhQmBmwfyqVrZmrGMIkcsoOd7nJjRDCmSp3McypB2mLK8Vk8tGgfNQC9KslbF337"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
5ea3ff862b802bd6-FRA
expires
Fri, 30 Oct 2020 09:15:47 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
89 KB
18 KB
Stylesheet
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
18335
x-cache-hit
HIT
last-modified
Mon, 26 Oct 2020 10:43:08 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
WNFAFytT94ERbYBQ1fOmR682e7w1T_MGXQ9ALHIua_cSaiBzybD1bg==
expires
Fri, 30 Oct 2020 23:42:23 GMT
jquery.js
threatpost.com/wp-includes/js/jquery/
95 KB
37 KB
Script
General
Full URL
https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Content-Encoding
gzip
Last-Modified
Tue, 01 Sep 2020 19:07:35 GMT
Server
nginx
ETag
W/"5f4e9bf7-17a69"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:34 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
177 KB
55 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
56256
x-cache-hit
HIT
last-modified
Mon, 26 Oct 2020 10:43:09 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
GnbKbvMwn9gZwAJnkRnPgSBQIGwQn7m0lOSBQgZc0Xw-cTVbIAqtgw==
expires
Fri, 30 Oct 2020 23:42:14 GMT
FinSpy-malware-macOS-Linux.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/28134930/
133 KB
134 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/28134930/FinSpy-malware-macOS-Linux.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cceafb3cf0f7c5d834899998b9075ae162e2dafa356a0cbb0200b1597be30871

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 28 Sep 2020 19:10:11 GMT
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Mon, 28 Sep 2020 17:49:32 GMT
server
AmazonS3
age
2728764
etag
"309c4f7d6ae893b48bd25c41cf784ac8"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, ZAG50-C1
accept-ranges
bytes
content-length
136501
x-amz-cf-id
2VJ-a1pbvPPWnQjJD8I4s6mp0A9FzKPgE_Xg1vkpPD2VSlhloJGtvQ==
expires
Tue, 28 Sep 2021 17:49:30 GMT
api.js
www.google.com/recaptcha/
850 B
793 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?hl=en
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
ba94eaf90519494de4ee847524ee2d3567f8518dbd66dcb0a5f610cee321976d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
554
x-xss-protection
1; mode=block
expires
Fri, 30 Oct 2020 09:09:34 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
2 KB
1 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
926
x-cache-hit
HIT
last-modified
Mon, 26 Oct 2020 10:43:07 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
yqwfgcjinAxW-h_7kWEj3a1mo2-0VgFn_v5LpNdLbXsgwLnzzHgPog==
expires
Fri, 30 Oct 2020 23:42:14 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/
34 KB
12 KB
Script
General
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:06 GMT
Server
nginx
ETag
W/"5f96a83a-88c2"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:35 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
7 KB
3 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
2685
x-cache-hit
HIT
last-modified
Mon, 26 Oct 2020 10:43:07 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
Juxx1LgJVb-JwAEsSyWNt9aB005MJ4bvCw5YrxJV0uzbgHwqvjfGHA==
expires
Fri, 30 Oct 2020 23:42:28 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
5 KB
2 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
1747
x-cache-hit
HIT
last-modified
Mon, 26 Oct 2020 10:43:06 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
cL_dBD9l6OJHgdHL1eat0B59CJJUssiO7u3JRQ2YM3UmwE5L-thzCA==
expires
Fri, 30 Oct 2020 23:42:23 GMT
api.js
www.google.com/recaptcha/
852 B
971 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
4473451078db552a3e4c47e578a385fee86f57ba923d26d0516e2231a81e2a9e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
555
x-xss-protection
1; mode=block
expires
Fri, 30 Oct 2020 09:09:34 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/
2 KB
1 KB
Script
General
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=c3405af2
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
973
x-cache-hit
HIT
last-modified
Tue, 01 Sep 2020 19:07:35 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
Y0cySJzMbRLwmBauBRJHzKxpQpsNVnrhZRMKwhmnDCz3HCZSnmdJVg==
expires
Fri, 30 Oct 2020 23:42:23 GMT
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 18:00:05 GMT
content-encoding
gzip
age
1609770
x-cache
Hit from cloudfront
status
200
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
6c8h_3RD6f656XwnYRof8IX6d32qHEGs5dA_LMMjD8nPR0l2JDzhfg==
bl-04a3385-22b14432.js
tagan.adlightning.com/math-aids-threatpost/
95 KB
28 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-22b14432.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
87edde1bfc1e770086806bbe02ad8eee3d40f76a82b55ef81497d3d1dda51a89

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 29 Oct 2020 19:35:34 GMT
content-encoding
gzip
age
48841
x-cache
Hit from cloudfront
status
200
content-length
27699
x-amz-meta-git_commit
04a3385
last-modified
Thu, 29 Oct 2020 19:35:00 GMT
server
AmazonS3
etag
"fed8f8cd3c88f331716ec3b79e4f735d"
x-amz-version-id
pCA459vT25VqiR535fttD09iSJPaTupR
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
EsXgCZRoF20h0jf0kA1oufwBDwojebvOx7WoaorTswCN7w4DTRkHfw==
pubads_impl_2020102201.js
securepubads.g.doubleclick.net/gpt/
274 KB
97 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102201.js?21068364
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
sffe /
Resource Hash
9ccb61031667dbac3cdba7043e98c6db961e044679dc28b81eb11031dd4ce45f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 22 Oct 2020 08:43:18 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
98380
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:34 GMT
vendor-list.json
qd.admetricspro.com/js/cmp2/
286 KB
28 KB
XHR
General
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e0::ac40:631c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
status
200
cf-request-id
061a5e09d2000097b43e933000000001
last-modified
Tue, 06 Oct 2020 19:31:27 GMT
server
cloudflare
etag
W/"4773b-5b105a5302c6b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1gi9x1Kg3yEWMhmmzBvUB9kYdIm%2FG47bF%2BAS9%2BAsUS%2BlXwcFlf8XvmCcx%2B8hvV3MiZCqCjXnDIAnYbrnhe1wbTXBxbYbNn4nfBazZkgjFH7veJi7pSRHugR4wrrPZiFU"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
5ea3ff894d4f97b4-FRA
expires
Fri, 30 Oct 2020 09:19:34 GMT
apstag.js
c.amazon-adsystem.com/aax2/
114 KB
29 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:01:49 GMT
content-encoding
gzip
server
Server
age
465
etag
14b87a812615d68493a97e70b7b323fb
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=900
x-amz-cf-pop
ZAG50-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
74slTgE3f2rqzua1RtFIFzXIKbopgrhidFzrnbQQBzPGW8yYn-wRdQ==
via
1.1 17c1f7944e7f0a7a5535cc3cecf1da09.cloudfront.net (CloudFront)
connatix.player.dc.js
cds.connatix.com/p/71742/ Frame D006
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/71742/connatix.player.dc.js
893 KB
221 KB
Script
General
Full URL
https://cds.connatix.com/p/71742/connatix.player.dc.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fc20c0234d0486ba6024b34827382aa1f2193bf95005925a3eb3f85eedb31e29

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
age
86046
x-cache
HIT, HIT
status
200
content-length
225400
x-served-by
cache-dca17776-DCA, cache-hhn4037-HHN
access-control-allow-origin
*
last-modified
Thu, 29 Oct 2020 08:27:40 GMT
x-timer
S1604048974.382638,VS0,VE0
etag
"fc8af5a00d7a1857f519dd9d8f082028"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 743

Redirect headers

date
Fri, 30 Oct 2020 09:09:34 GMT
via
1.1 varnish
server
Varnish
age
0
x-served-by
cache-fra19140-FRA
status
302
x-cache
HIT
location
https://cds.connatix.com/p/71742/connatix.player.dc.js
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
x-timer
S1604048974.349879,VS0,VE0
content-length
0
retry-after
0
x-cache-hits
0
/
kasperskycontenthub.com/
0
399 B
Script
General
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=772519217&back=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
MISS
Transfer-Encoding
chunked
X-Debug-Auth
off
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/
152 KB
49 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
960d6f50ac3a8e11b5ab68b5a561e0b330a5a9faec638023b9c8d3f1a4465711
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49584
x-xss-protection
0
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 30 Oct 2020 09:09:34 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/
13 KB
5 KB
Other
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:20 GMT
Server
nginx
ETag
W/"5f96a848-3496"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:35 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/
13 KB
5 KB
Other
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
W/"5f96a83c-3496"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:35 GMT
logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
19 KB
19 KB
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-4a32"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
18994
Expires
Fri, 06 Nov 2020 09:09:35 GMT
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20900
Expires
Sat, 30 Oct 2021 09:09:34 GMT
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20680
Expires
Sat, 30 Oct 2021 09:09:34 GMT
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20920
Expires
Sat, 30 Oct 2021 09:09:34 GMT
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
20 KB
21 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20884
Expires
Sat, 30 Oct 2021 09:09:34 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
263 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=9531d545-edfa-4bbf-8aae-20714ecc0cb3&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.31221881204682456
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
d1e739b271e6bb6861bc19eeb0f50dd805a5e7e0672fe5a63a364edff3749637

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
263
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=2f1c6adf-cde4-4fc0-9dbf-644991437c2c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6405366048007863
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
a063d9b8cf1ec434b4aadd6d0686bbcab230fc03a193a8bcc97610c92d249538

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=754a90d7-020e-4123-920c-4dbfba49d7f0&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8273295461477717
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
2f4dc58ccb9912a2f007bd9f09b089a9aa9fedec3064571def6330de4b486e7a

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
261 B
2 KB
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=754a90d7-020e-4123-920c-4dbfba49d7f0&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9267252222854236
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
2314dedd26d85f0f25afce54a05894a3eebee121d15f238fef733b6c89c386ed

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Keep-Alive
timeout=5
Content-Length
261
Expires
Wed, 17 Sep 1975 21:32:10 GMT
cygnus
htlb.casalemedia.com/
24 B
371 B
XHR
General
Full URL
https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22688dd4e9c99d48%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22776e3d729b06c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22805a16df73f168%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22968f50c376f1e9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22776e3d729b06c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22776e3d729b06c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22805a16df73f168%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22968f50c376f1e9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f56910ebecad8f317e57e178a0503f7d49c3d44ffe8f7ed3a23ffaa4d452aed7

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[89.249.64.171], XFF:[]
server
Apache
status
200
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
44
x-ak-client-geo
12
expires
Fri, 30 Oct 2020 09:09:34 GMT
translator
hbopenbid.pubmatic.com/
0
115 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:34 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
bid
ap.lijit.com/rtb/
96 B
759 B
XHR
General
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx /
Resource Hash
6dbec1fc31acffd0443fc8e36d9ad0f5a3dd366d06fbdab024da0b61dcee1557

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 30 Oct 2020 09:09:34 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap6ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
100
prebid
ib.adnxs.com/ut/v3/
19 B
710 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.244 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.250:80
AN-X-Request-Uuid
b0de70d1-9cd3-4d5a-9be1-66cd7ecaab15
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/
361 B
1 KB
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.244 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
6a3107b93f81663eb7023a8d8bd8315f9a68c0d7c3e4fdd937f25ef320ed2502
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:34 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.74:80
AN-X-Request-Uuid
ec30ad11-142f-4ae2-9950-34d610f636e2
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
361
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
tlx.3lift.com/header/
19 B
476 B
XHR
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&tmax=1200&gdpr=false
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.134.97 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-134-97.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
status
200
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
v2
e.serverbid.com/api/
16 B
168 B
XHR
General
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
200
date
Fri, 30 Oct 2020 09:09:34 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
content-length
16
vary
Origin
content-type
application/json
ADTECH;apid=1Aa1015a3a-1a8f-11eb-ae02-12724de64e5e;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1Aa1015a3a-1a8f-11eb-ae02-12724de64e5e;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=16...
1 KB
1 KB
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1Aa1015a3a-1a8f-11eb-ae02-12724de64e5e;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
ed976fa6d67aa0878873ebbede82de4734c75c18688f61b996d30580f6691a07

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
1469
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1Aa1015a3a-1a8f-11eb-ae02-12724de64e5e;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=5888615b2a505e2;misc=1604048974623
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1Aa1013d34-1a8f-11eb-a362-12d2f833f2cc;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1Aa1013d34-1a8f-11eb-a362-12d2f833f2cc;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604...
1 KB
1 KB
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1Aa1013d34-1a8f-11eb-a362-12d2f833f2cc;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
e158f62efbcbccd3ee08139ff2fe754284bb67739c11b3394f7cda32457acf41

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
1469
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1Aa1013d34-1a8f-11eb-a362-12d2f833f2cc;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=593647589ca53;misc=1604048974623
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=16...
1 KB
2 KB
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
404fc0019db1f038122d963cd29abeee0da03bb1c637d9fd8dcfcbb979105fc7

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
1469
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=60e1e5eabf876c2;misc=1604048974623
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1Aa100f1bc-1a8f-11eb-9032-1248c7260bf4;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1Aa100f1bc-1a8f-11eb-9032-1248c7260bf4;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=16...
1 KB
2 KB
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1Aa100f1bc-1a8f-11eb-9032-1248c7260bf4;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
8639ccb4c80fb575ad9afdeafaede459d551abe55ba849c601fac618f8b7b8a9

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
x-adtech-meta
{"Debug": {"IP": "0.0.0.0", "Selector": "pri-select006c.us-east-1.prod.adtech.aolcloud.net", "UserId": "348FB47F94D6ADA44C128AD5FF766133"}}
content-length
1469
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1Aa100f1bc-1a8f-11eb-9032-1248c7260bf4;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=61d5dbf804f2439;misc=1604048974623
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
ADTECH;apid=1Aa10153a0-1a8f-11eb-a710-12052abf3156;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1604048973;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1Aa10153a0-1a8f-11eb-a710-12052abf3156;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=16...
1 KB
1 KB
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1Aa10153a0-1a8f-11eb-a710-12052abf3156;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
7fad67a2de7d18ad1ceb6151c78c279dab655f6ca96138ef97ed470333e3c237

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
1469
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1Aa10153a0-1a8f-11eb-a710-12052abf3156;cfp=1;rndc=1604048974;v=2;cmd=bid;cors=yes;alias=623085c40977993;misc=1604048974624
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://threatpost.com
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
arj
teachingaids-d.openx.net/w/1.0/
174 B
560 B
XHR
General
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9531d545-edfa-4bbf-8aae-20714ecc0cb3%2C9531d545-edfa-4bbf-8aae-20714ecc0cb3%2C2f1c6adf-cde4-4fc0-9dbf-644991437c2c%2C754a90d7-020e-4123-920c-4dbfba49d7f0%2C754a90d7-020e-4123-920c-4dbfba49d7f0&nocache=1604048974625&gdpr=0&x_gdpr_f=1&pubcid=60ce236f-537b-4cad-86cb-c90d8d832b70&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash
4cdedf70376efbcabd5b556cac4ca0da0324bee9e46080b134ba160c74c0da83

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
server
OXGW/16.196.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
c
prebid.a-mo.net/a/
912 B
847 B
XHR
General
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e2cf14e06244158f420cb73a4d75aa85c60020fd4701c0bb5ea726226c2214b3

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
server
envoy
status
200
vary
origin, accept-encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
54
content-length
420
adreq
ads.servenobid.com/
317 B
475 B
XHR
General
Full URL
https://ads.servenobid.com/adreq?cb=5915
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.177.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-210-177-43.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e8347b75be6fd8c8526f52623bf351ff37e10b34e1f93f243d5e80adeffb36c8

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
status
200
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials
true
Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/
13 KB
13 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 01 Oct 2020 00:04:39 GMT
via
1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Fri, 17 Aug 2018 16:22:08 GMT
server
AmazonS3
age
2538296
etag
"dee18dfeea6de13bec60c1e5237eb723"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, ZAG50-C1
accept-ranges
bytes
content-length
13097
x-amz-cf-id
msjkW0ldX5ujv4uxe14Q8hqiaBS7ZRhdsuG6-siFUVLvgQGxi8hphQ==
expires
Sat, 17 Aug 2019 16:22:07 GMT
subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/
8 KB
9 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 22 Sep 2020 08:11:35 GMT
via
1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Tue, 19 Feb 2019 20:14:58 GMT
server
AmazonS3
age
3286680
etag
"5ba45563f793f39ef6baf02645651654"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, ZAG50-C1
accept-ranges
bytes
content-length
8281
x-amz-cf-id
Z1Ys0ky8hezUiEsJMhYG9EwwgulSWm9VoIS-wyfVMji4fSSi_Kq55Q==
expires
Wed, 19 Feb 2020 20:14:57 GMT
xfinity-1-e1603919947345-540x270.png
media.threatpost.com/wp-content/uploads/sites/103/2020/10/28171733/
175 KB
176 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/28171733/xfinity-1-e1603919947345-540x270.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c6754451b2b215e37d3c1e147e7251a6da89a894591dc77581e061fed72e61fa

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 29 Oct 2020 10:01:38 GMT
via
1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Wed, 28 Oct 2020 21:19:43 GMT
server
AmazonS3
age
83277
etag
"9fa33d1770d86f6ffa25d2abef3e4576"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, ZAG50-C1
accept-ranges
bytes
content-length
179460
x-amz-cf-id
oU247hwPNda0dJJ5BCkQxLCvTx2QGFJVF0JCiPm_0-VCuMDmyF2ecA==
expires
Thu, 28 Oct 2021 21:19:39 GMT
malware-download-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/05121235/
19 KB
20 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/05121235/malware-download-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0b53158fac1f17ebd5a4939bd127529b81b44c261bbf65506b151ccae4071617

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 20:53:39 GMT
via
1.1 4f2586d7d5737aae9f5500126b9eb2ba.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Mon, 05 Oct 2020 16:12:38 GMT
server
AmazonS3
age
216956
etag
"1c68adeae4917b89a73ad10abd2eec7d"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
MUC51-C1, ZAG50-C1
accept-ranges
bytes
content-length
19516
x-amz-cf-id
wUtwpJA-4mDzJ7BG9l6eUfgnk4IvTGPhH1HmZxxmZiicTsQziNVudA==
expires
Tue, 05 Oct 2021 16:12:37 GMT
mottech-fields_agriculture-irrigation-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/27174723/
23 KB
23 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/27174723/mottech-fields_agriculture-irrigation-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06379eb7b2cef3b07276dcc5698f1039361c8480fe6ec49d55fc4f45d8664703

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 27 Oct 2020 21:48:33 GMT
via
1.1 acdc9751ec7d7c0362dd50a8a6f5e814.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Tue, 27 Oct 2020 21:47:39 GMT
server
AmazonS3
age
213662
etag
"5f8f8b842cff25d09c64a11251358a9d"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
MUC51-C1, ZAG50-C1
accept-ranges
bytes
content-length
23093
x-amz-cf-id
b96fOyK91hj4f0eYV8BEfBMLBcFYnuCD-v4pa9C_jVyiajFO8cIdCA==
expires
Wed, 27 Oct 2021 21:47:36 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/
343 KB
135 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 08:25:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2668
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
137574
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 04:07:53 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 30 Oct 2021 08:25:06 GMT
e
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/e
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
828 B
722 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
W/"5f96a83c-33c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:35 GMT
twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
868 B
847 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
W/"5f96a83c-364"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:34 GMT
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/
15 KB
16 KB
Font
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin
https://threatpost.com
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:34 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:08 GMT
Server
nginx
ETag
"5f96a83c-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
15820
Expires
Sat, 30 Oct 2021 09:09:34 GMT
connatix.player.css
cds.connatix.com/p/71742/
54 KB
9 KB
Stylesheet
General
Full URL
https://cds.connatix.com/p/71742/connatix.player.css
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9c4740903ba9c8accf0a82a96c4553065510bc6b1a486715c2cfd79b8cfd3f6c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
age
86048
x-cache
HIT, HIT
status
200
content-length
8796
x-served-by
cache-dca17758-DCA, cache-hhn4037-HHN
access-control-allow-origin
*
last-modified
Thu, 29 Oct 2020 08:27:40 GMT
x-timer
S1604048975.730860,VS0,VE0
etag
"cd4d821b09e618e8a4f16a309d185bcc"
vary
Accept-Encoding
content-type
text/css
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
2, 5137
mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
812 B
722 B
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Last-Modified
Mon, 26 Oct 2020 10:43:20 GMT
Server
nginx
ETag
W/"5f96a848-32c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Fri, 06 Nov 2020 09:09:35 GMT
logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/
10 KB
10 KB
Image
General
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
public
Date
Fri, 30 Oct 2020 09:09:35 GMT
Last-Modified
Mon, 26 Oct 2020 10:43:20 GMT
Server
nginx
ETag
"5f96a848-260a"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
9738
Expires
Fri, 06 Nov 2020 09:09:35 GMT
Trump-Biden-Cyberattacks-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/
3 KB
3 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/Trump-Biden-Cyberattacks-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 13:33:00 GMT
via
1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Thu, 10 Sep 2020 20:09:08 GMT
server
AmazonS3
age
156995
etag
"02d819dba7c37960134535d631118aeb"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, ZAG50-C1
accept-ranges
bytes
content-length
2847
x-amz-cf-id
S5b1P91hSxb-jfq2egpf4QtdtCmduMTl9wN7PcLcfx93Ph0x6jyeUg==
expires
Fri, 10 Sep 2021 20:09:07 GMT
voting-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/
2 KB
3 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/voting-64x64.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 13:48:50 GMT
via
1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Thu, 20 Aug 2020 19:26:03 GMT
server
AmazonS3
age
760845
etag
"9293f3ef83c25d01935212cace875cd7"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1, ZAG50-C1
accept-ranges
bytes
content-length
2112
x-amz-cf-id
TQeOssQutbAQI03-wnVKbSZHyHkgUHalUQeDaoFHbZAfTHYqKHqbqw==
expires
Fri, 20 Aug 2021 19:26:00 GMT
QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/
8 KB
9 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Sep 2020 19:19:50 GMT
via
1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Tue, 15 Sep 2020 17:58:41 GMT
server
AmazonS3
age
3851385
etag
"f2a1360e4c2d784aff00a9f87f6bb703"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, ZAG50-C1
accept-ranges
bytes
content-length
8421
x-amz-cf-id
tAsXCxkpIRpgL_mQo2BmI6-foEdgCNTfvSY4TBv7JUKEAv-Y_fqKCg==
expires
Wed, 15 Sep 2021 17:58:37 GMT
botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/
2 KB
2 KB
Image
General
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:da00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 29 Sep 2020 17:17:17 GMT
via
1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront), 1.1 e9ebe38de33a70557cf9d9c1d7e5d11f.cloudfront.net (CloudFront)
last-modified
Thu, 14 Nov 2019 14:06:22 GMT
server
AmazonS3
age
2649138
etag
"985f90dddb9367ad3b074a54645a8bc3"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
DUS51-C1, ZAG50-C1
accept-ranges
bytes
content-length
1866
x-amz-cf-id
k8b-nnN1b_MxRHCHbOcORz7WMRucKhRtJP-bOaX63RkV5zRaf5IMJw==
expires
Fri, 13 Nov 2020 14:06:19 GMT
pls
capi.connatix.com/core/ Frame D006
7 KB
3 KB
XHR
General
Full URL
https://capi.connatix.com/core/pls?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
474150367e119d36f2aea719a965c2a4452efa8629e60b2b58311e98006d5e20

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
transfer-encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
analytics.js
www.google-analytics.com/
46 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
4809
date
Fri, 30 Oct 2020 07:49:25 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Fri, 30 Oct 2020 09:49:25 GMT
quant.js
secure.quantserve.com/
23 KB
9 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
etag
"O/+l6c17R2TQ0JQMJXOiXA=="
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Fri, 06 Nov 2020 09:09:34 GMT
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
content-encoding
gzip
age
41819
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1958
x-served-by
cache-hhn4076-HHN
last-modified
Wed, 21 Oct 2020 21:46:56 GMT
x-timer
S1604048975.882005,VS0,VE0
etag
"a4cc3f907681b24a3efd540acd5d2996+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
bid
c.amazon-adsystem.com/e/dtb/
23 B
368 B
XHR
General
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&pid=2JVsDmC7AkY2g&cb=0&ws=1600x1200&v=7.57.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:34 GMT
via
1.1 17c1f7944e7f0a7a5535cc3cecf1da09.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
ZAG50-C1
status
200
vary
User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
AEhF01g4RufAVHSZmZCo8c1g-omvEz9cc6w2CfTkxYsm7OM73dSx2g==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 29 Oct 2020 10:19:22 GMT
content-encoding
gzip
vary
Origin
age
82213
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Wed, 30 Sep 2020 05:43:29 GMT
server
AmazonS3
etag
"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 447f0defb04b912ed949f0fdd5a6492e.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
ZAG50-C1
x-amz-cf-id
JRxYoUXzZ0t7ZOhcqYLYbxUDtRMEUgli3gCI5V0TpVvHTRIN05pcug==
collect
www.google-analytics.com/j/
2 B
125 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=516621643&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Russian%20Espionage%20Group%20Updates%20Custom%20Malware%20Suite%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1943318349&gjid=1107624542&cid=2127540100.1604048975&tid=UA-35676203-21&_gid=1168307160.1604048975&_r=1&gtm=2wgal2PM29HLF&z=559282095
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
405 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=516621643&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Russian%20Espionage%20Group%20Updates%20Custom%20Malware%20Suite%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=2127540100.1604048975&tid=UA-35676203-21&_gid=1168307160.1604048975&gtm=2wgal2PM29HLF&z=2014701328
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Oct 2020 14:32:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
67002
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/
3 B
358 B
Script
General
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:ac00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:05:17 GMT
via
1.1 98e6142a124268fae259e9413f391903.cloudfront.net (CloudFront)
last-modified
Fri, 03 Mar 2017 23:52:35 GMT
server
AmazonS3
age
259
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Error from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=300
x-amz-cf-pop
ZAG50-C1
accept-ranges
bytes
content-length
3
x-amz-cf-id
bOgrf5PoR8WBr_GSNBX-d4pDKZoT9AlM_8ZVqVr3NOgU_gkZGD9lGw==
adsct
t.co/i/
43 B
448 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
108
pragma
no-cache
last-modified
Fri, 30 Oct 2020 09:09:35 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
c36200f967c3ad59a5f342b3c635d964
x-transaction
00a30889001ff004
expires
Tue, 31 Mar 1981 05:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
87 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-35676203-21&cid=2127540100.1604048975&jid=1943318349&gjid=1107624542&_gid=1168307160.1604048975&_u=YEBAAEAAAAAAAC~&z=266525564
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 30 Oct 2020 09:09:34 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
253 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=2127540100.1604048975&jid=1943318349&_u=YEBAAEAAAAAAAC~&z=2008637556
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
106 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=2127540100.1604048975&jid=1943318349&_u=YEBAAEAAAAAAAC~&z=2008637556
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel;r=213403539;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-1536739957-...
pixel.quantserve.com/
35 B
372 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=213403539;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-1536739957-1604048975098;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1604048975098;tzo=-60;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F09%2F28134930%2FFinSp%2Ctype.article%2Ctitle.Russian%20Espionage%20Group%20Updates%20Custom%20Malware%20Suite%2Cdescription.Turla%20has%20outfitted%20a%20trio%20of%20backdoors%20with%20new%20C2%20tricks%20and%20increased%20interop%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Frussian-espionage-custom-malware%2F160673%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status
200
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
integrator.js
adservice.google.de/adsid/
109 B
316 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
109 B
168 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
232 KB
44 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=850469350768415&correlator=3319345717521551&output=ldjh&impl=fifs&eid=21067994%2C21068364%2C21068031&vrg=2020102201&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201030&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Frussian-espionage-custom-malware%252F160673%252F%26urlquery%3Dgoogfc%26contentid%3D160673%26category%3Dgovernment%26contenttags%3Daccenture%252Cbackdoor-0%252Ccarbon%252Ccommand-and-control%252Ccustom-malware%252Ccyberattack%252Cespionage%252Ceurope%252Cgovernment-target%252Chyperstack%252Ckazuar%252Cmalware-analysis%252Couroboros%252Cpastebin%252Crat%252Cremote-access-trojan%252Crussia%252Csecond-stage-malware%252Csnake%252Cspy-group%252Cturla%252Curoboros%252Cvenomous-bear%252Cwaterbug&cookie_enabled=1&bc=31&abxe=1&lmt=1604048975&dt=1604048975192&dlt=1604048973753&idt=490&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1532%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&dssz=45&icsg=167785091&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=2127540100.1604048975&ga_sid=1604048975&ga_hid=516621643&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102201.js?21068364
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
cafe /
Resource Hash
426b6106cfafebd9ac03053cb06b441aed47c5df3956ad9a69260981db92779c
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNv8_or82-wCFURO4AodpkcK5w&gqi=&layout=/sadbundle/%24csp%253Der3%24/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNr8_or82-wCFURO4AodpkcK5w&gqi=&layout=/sadbundle/%24csp%253Der3%24/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNv8_or82-wCFURO4AodpkcK5w&gqi=&layout=/sadbundle/%24csp%253Der3%24/17091077042359084972/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-3/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNr8_or82-wCFURO4AodpkcK5w&gqi=&layout=/sadbundle/%24csp%253Der3%24/17862345635743927496/Minijob_Zentrale_Online_Banner_Studierende__GDN__300x250px_Ad-4/index.html
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
google-creative-id
-1,-1,-1,138301519116
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43356
x-xss-protection
0
google-lineitem-id
-1,-1,-1,5283645110
pragma
no-cache
server
cafe
google-mediationtag-id
-2
date
Fri, 30 Oct 2020 09:09:35 GMT
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/
0
0
Other
General
Full URL
https://9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::84 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

v1
geo.ipify.org/api/
482 B
1 KB
XHR
General
Full URL
https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS
threatintelligenceplatform.com
Software
nginx /
Resource Hash
e81f159ba3c6c18a88e66ecc621ddefedf80ac94a503eeaa77e5312bef71b9fc
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/
236 B
566 B
Image
General
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
public
date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 10:43:07 GMT
server
nginx
x-amz-cf-pop
ZAG50-C1
etag
W/"5f96a83b-ec"
x-cache
Miss from cloudfront
content-type
image/svg+xml
status
200
cache-control
max-age=604800, public
x-amz-cf-id
Gxy0CC7-FkeiIBtMT2eYILGLe0hDAJGhFJAE-I5L2WzpFYV2LlCgXQ==
via
1.1 9680e9cb5cbc773ebfed1b7a558f7db6.cloudfront.net (CloudFront)
expires
Fri, 06 Nov 2020 09:09:35 GMT
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/
75 KB
76 KB
Font
General
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20d7:7e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin
https://threatpost.com
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 3108e2685e0e061c5abe75f40944947d.cloudfront.net (CloudFront)
x-amz-cf-pop
ZAG50-C1
x-cache
Miss from cloudfront
status
200
content-length
77160
pragma
public
last-modified
Mon, 26 Oct 2020 10:43:08 GMT
server
nginx
etag
"5f96a83c-12d68"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public
accept-ranges
bytes
x-amz-cf-id
I8aa5lADMuin_KWeGm1aP-HZUXGsYt4VklAXfaT_QpMz8s1Yiq4Bzw==
expires
Sat, 30 Oct 2021 09:09:35 GMT
adsct
analytics.twitter.com/i/
31 B
652 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
117
pragma
no-cache
last-modified
Fri, 30 Oct 2020 09:09:35 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
687681ff50ad8802ed5f414f49d0ef43
x-transaction
0059c4a000a0f3c1
expires
Tue, 31 Mar 1981 05:00:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame 0B3C
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=71z45ns2u349
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-SVIpQlSmNRCUT06ErRgbGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=71z45ns2u349
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Fri, 30 Oct 2020 09:09:35 GMT
content-security-policy
script-src 'report-sample' 'nonce-SVIpQlSmNRCUT06ErRgbGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
11220
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sr
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/sr?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
3_media.bin
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
232 B
469 B
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
age
636172
x-cache
HIT, HIT
status
200
content-length
204
x-served-by
cache-bwi5145-BWI, cache-fra19174-FRA
last-modified
Thu, 17 Sep 2020 01:42:41 GMT
x-timer
S1604048975.488174,VS0,VE0
etag
"796c77896c9738780ae744fd3eb73483"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 1
1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/
4 KB
5 KB
Image
General
Full URL
https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 varnish, 1.1 varnish
age
3020181
x-cache
HIT, HIT
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status
200
fastly-stats
io=1
content-encoding
gzip
content-length
4351
x-served-by
cache-dca17763-DCA, cache-fra19140-FRA
x-timer
S1604048975.464232,VS0,VE1
etag
"E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary
Accept
x-amz-request-id
73558CDC7A440D38
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/webp
x-cache-hits
2, 1
/
graph.facebook.com/
202 B
584 B
XHR
General
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
116b7304c277667fe89b184f01d7ab13b8f81fb3378d21fc8b38c7f927f25d7b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status
400
x-fb-rev
1002911287
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
149
pragma
no-cache
x-fb-debug
3ZMC6vGryUTg9JTKt5BreQJMdjR8jvHTBFGrvRI7j4oXbPfoxAGUK5D/jje5eKYa1yj44Otys2rPDoXaqoT2Lw==
x-fb-trace-id
E4sHFN2ZUR9
date
Fri, 30 Oct 2020 09:09:35 GMT
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-fb-request-id
AGBXhDJ2AXq7kX3nFFEOBsI
cache-control
no-store
facebook-api-version
v3.2
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
0
0
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F&format=jsonp&callback=jQuery112408572938176011355_1604048974460&_=1604048974461
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

info.json
www.reddit.com/api/
102 B
1 KB
XHR
General
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 varnish
x-content-type-options
nosniff
status
200
content-length
102
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges
bytes
expires
-1
anchor
www.google.com/recaptcha/api2/ Frame 06DF
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=rq0vmhk7g2va
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-mVS6n8N6Rypp1zoPVVF1eA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=rq0vmhk7g2va
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Fri, 30 Oct 2020 09:09:35 GMT
content-security-policy
script-src 'report-sample' 'nonce-mVS6n8N6Rypp1zoPVVF1eA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
11114
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ao
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/ao?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
ps
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/ps?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:35 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/
2 KB
2 KB
Image
General
Full URL
https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 varnish, 1.1 varnish
age
3060390
x-cache
HIT, HIT
fastly-io-info
ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status
200
fastly-stats
io=1
content-encoding
gzip
content-length
2066
x-served-by
cache-dca17763-DCA, cache-fra19140-FRA
x-timer
S1604048976.580674,VS0,VE1
etag
"iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary
Accept
x-amz-request-id
9718C29D2B1AEC8D
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/webp
x-cache-hits
1, 1
prebid3.25.0-1.js
cds.connatix.com/p/plugins/ Frame D006
286 KB
89 KB
Script
General
Full URL
https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
age
3972331
x-cache
HIT, HIT
status
200
content-length
90468
x-served-by
cache-dca17730-DCA, cache-hhn4037-HHN
access-control-allow-origin
*
last-modified
Mon, 14 Sep 2020 09:43:49 GMT
x-timer
S1604048976.590441,VS0,VE0
etag
"9c38c88a790efaae20de0f5391a27029"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
2, 17875
bframe
www.google.com/recaptcha/api2/ Frame 5923
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=cnkvxnktakif
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-mbyyb/zNK1XLhVSeBCyXMA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=cnkvxnktakif
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Fri, 30 Oct 2020 09:09:35 GMT
content-security-policy
script-src 'report-sample' 'nonce-mbyyb/zNK1XLhVSeBCyXMA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1173
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
playlist.m3u8
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
309 B
326 B
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
age
1936362
x-cache
HIT, HIT
status
200
content-length
164
x-served-by
cache-bwi5132-BWI, cache-fra19174-FRA
last-modified
Mon, 07 Sep 2020 18:49:42 GMT
x-timer
S1604048976.694723,VS0,VE1
etag
"8a966507b13615ecdc1330a4bc9dcfe1"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 1
openrtb
ads.adaptv.advertising.com/rtb/ Frame D006
0
215 B
XHR
General
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.64.232 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
prebid
ib.adnxs.com/ut/v3/ Frame D006
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.244 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:35 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.40:80
AN-X-Request-Uuid
e2a8842b-c368-4163-bc7d-1d5f2f9a1229
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame D006
92 B
282 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=cde88694-b3be-4807-8b22-b31b39047d86&nocache=1604048975750&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 google
server
OXGW/16.196.0
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame D006
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.244 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:35 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.41:80
AN-X-Request-Uuid
25436164-5f2a-4351-b94f-c2ce1d1ea013
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/ Frame D006
24 B
271 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%22907121ad46dbf4%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210b6ec25def7915%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
38bad52d2af003ec2a5f2fc2d6b37ba261e5cb8454ab3c84dffb0f95ca58ed3d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
server
Apache
status
200
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
44
expires
Fri, 30 Oct 2020 09:09:35 GMT
cygnus
as-sec.casalemedia.com/ Frame D006
25 B
272 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%22112d58ca0d77f94%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22126e1718a29875a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c7c1996ebe232df78acbe75e7967a34273c32debbb9f72cb9662bb86e205e718

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
server
Apache
status
200
vary
Is-Traffic-Invalid,Accept-Encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
45
expires
Fri, 30 Oct 2020 09:09:35 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame D006
92 B
285 B
XHR
General
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Frussian-espionage-custom-malware%2F160673%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=7942a1ee-06a4-4a4e-8d56-bbf9d834c748&nocache=1604048975759&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:35 GMT
via
1.1 google
server
OXGW/16.196.0
status
200
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
92
expires
Mon, 26 Jul 1997 05:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame D006
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:35 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
translator
hbopenbid.pubmatic.com/ Frame D006
0
59 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:36 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://threatpost.com
0.m3u8
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
5 KB
1 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
content-encoding
gzip
age
720003
x-cache
HIT, HIT
status
200
content-length
959
x-served-by
cache-bwi5145-BWI, cache-fra19174-FRA
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
x-timer
S1604048976.784456,VS0,VE1
etag
"3a71266b043248350b2f39a55da8294e"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 1
bframe
www.google.com/recaptcha/api2/ Frame F3C4
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=f5bx4wkt2fie
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-WM2QYoMKK9xQS1jpVQCzcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=f5bx4wkt2fie
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Fri, 30 Oct 2020 09:09:35 GMT
content-security-policy
script-src 'report-sample' 'nonce-WM2QYoMKK9xQS1jpVQCzcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1171
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bl-04a3385-22b14432.js
tagan.adlightning.com/math-aids-threatpost/ Frame 8427
95 KB
27 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-22b14432.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
87edde1bfc1e770086806bbe02ad8eee3d40f76a82b55ef81497d3d1dda51a89

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 29 Oct 2020 19:35:34 GMT
content-encoding
gzip
age
48842
x-cache
Hit from cloudfront
status
200
content-length
27699
x-amz-meta-git_commit
04a3385
last-modified
Thu, 29 Oct 2020 19:35:00 GMT
server
AmazonS3
etag
"fed8f8cd3c88f331716ec3b79e4f735d"
x-amz-version-id
pCA459vT25VqiR535fttD09iSJPaTupR
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
NncoXtRDVG8P3NR88aD_vGjk4Eu8rV6BSPuX29vgn8Fgf3dN7cWONw==
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/ Frame 8427
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 18:00:05 GMT
content-encoding
gzip
age
1609771
x-cache
Hit from cloudfront
status
200
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
1I_CC0mYmA9TlE1dcDKYBDl22UpnWsRUyjjpZe9jcSabwJvtWz1ReA==
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

status
200
retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Fri, 30 Oct 2020 09:09:35 GMT
x-served-by
cache-fra19174-FRA
x-cache
HIT
x-cache-hits
0
x-timer
S1604048976.844714,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
1 KB
2 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-1428

Response headers

date
Fri, 30 Oct 2020 09:09:35 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
2763449
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5137-BWI, cache-fra19174-FRA
status
206
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 0-1428/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1604048976.860633,VS0,VE0
access-control-allow-origin
*
Content-Length
1429
x-cache-hits
2, 1
container.html
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 522B
0
0
Document
General
Full URL
https://9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c0c::84 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-37/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
2973
date
Fri, 30 Oct 2020 09:09:35 GMT
expires
Sat, 30 Oct 2021 09:09:35 GMT
last-modified
Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
0
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
container.html
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame E1D1
0
0
Document
General
Full URL
https://9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c0c::84 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-37/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
2973
date
Fri, 30 Oct 2020 09:09:35 GMT
expires
Sat, 30 Oct 2021 09:09:35 GMT
last-modified
Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
0
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bl-04a3385-22b14432.js
tagan.adlightning.com/math-aids-threatpost/ Frame E622
95 KB
27 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-22b14432.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
87edde1bfc1e770086806bbe02ad8eee3d40f76a82b55ef81497d3d1dda51a89

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 29 Oct 2020 19:35:34 GMT
content-encoding
gzip
age
48842
x-cache
Hit from cloudfront
status
200
content-length
27699
x-amz-meta-git_commit
04a3385
last-modified
Thu, 29 Oct 2020 19:35:00 GMT
server
AmazonS3
etag
"fed8f8cd3c88f331716ec3b79e4f735d"
x-amz-version-id
pCA459vT25VqiR535fttD09iSJPaTupR
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
sxe6DyFCTA76fm8nU4Z7FFVbGT04-Cy6kwAo2tLCDhiO4QERvFzpXA==
b-9a4f7ce-a7f6098c.js
tagan.adlightning.com/math-aids-threatpost/ Frame E622
61 KB
21 KB
Script
General
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.127 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-2-127.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 11 Oct 2020 18:00:05 GMT
content-encoding
gzip
age
1609771
x-cache
Hit from cloudfront
status
200
content-length
20808
x-amz-meta-git_commit
9a4f7ce
last-modified
Tue, 18 Aug 2020 17:45:57 GMT
server
AmazonS3
etag
"98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id
PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via
1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
RTa-bZlU8QqydZJWVqrCwv-ReHffe1QUrozpZHMxX3qJszEd-h3RsQ==
7464639028652035684
tpc.googlesyndication.com/simgad/ Frame E622
330 B
502 B
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/7464639028652035684
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 02:48:04 GMT
x-content-type-options
nosniff
age
22891
x-dns-prefetch-control
off
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
330
x-xss-protection
0
last-modified
Tue, 28 Jan 2020 23:02:00 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Oct 2021 02:48:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20201027/r20110914/ Frame E622
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20201027/r20110914/abg_lite_fy2019.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
51b80b713d82dafe9d86ff2b83dd557f60cbf887ac76483df35a75e6479b59c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 07:23:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6378
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7216
x-xss-protection
0
server
cafe
etag
18075241702106780385
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 13 Nov 2020 07:23:17 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20201027/r20110914/client/ Frame E622
3 KB
2 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20201027/r20110914/client/window_focus_fy2019.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 07:20:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6556
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1336
x-xss-protection
0
server
cafe
etag
4033927919502905291
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 13 Nov 2020 07:20:19 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame E622
74 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bfcd5cce51aa77a183d418b0848ed62e532f99e5c4943934298593eb7acd284b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1603885550448160"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28759
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:36 GMT
l
www.google.com/ads/measurement/ Frame E622
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTXE7JDz2mRx6XMgZ6VCpr8qNrC282gK2dnNDB2G5wuEIMzu_iJ-dHuskbrl3Ro85MNDWLp
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

osd.js
www.googletagservices.com/activeview/js/current/
72 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102201.js?21068364
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
34d9891a81b9b276febf3b6f763ededd97fc364bd399e9446f71159be6cb1d0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1603885550448160"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
27554
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:36 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012010200130000/ Frame 8427
204 KB
56 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c2206501c5a898123871431da1a1ff12bcaf46194db997e6c9237296d9859daa
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
50726
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
56832
x-xss-protection
0
server
sffe
date
Thu, 29 Oct 2020 19:04:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"fc56d6feccb35077"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Oct 2021 19:04:10 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012010200130000/v0/ Frame 8427
14 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010200130000/v0/amp-ad-exit-0.1.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4653687f2f0571ecaf6723d7743f92edf52159c03a8181763cb73031ad8a64bf
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
50727
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5337
x-xss-protection
0
server
sffe
date
Thu, 29 Oct 2020 19:04:09 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"daa4412bcb5a8fd6"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Oct 2021 19:04:09 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012010200130000/v0/ Frame 8427
96 KB
29 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010200130000/v0/amp-analytics-0.1.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c799c0a055898234d3692565188b828d2d41b3056cf5bbd2584e729968829b72
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
50726
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29527
x-xss-protection
0
server
sffe
date
Thu, 29 Oct 2020 19:04:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f91dfcaf1b61c8c5"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Oct 2021 19:04:10 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012010200130000/v0/ Frame 8427
4 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010200130000/v0/amp-fit-text-0.1.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e5c41077aafced98067ed5bad36d0518235b45963f432237d11d8b89c8d00873
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
50726
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1792
x-xss-protection
0
server
sffe
date
Thu, 29 Oct 2020 19:04:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"2c1d882225e4ba30"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Oct 2021 19:04:10 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012010200130000/v0/ Frame 8427
45 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012010200130000/v0/amp-form-0.1.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d8865bb32d3ba618981090df05f9de09607c1f65764a7434016926de0a8fbcd
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
50726
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14145
x-xss-protection
0
server
sffe
date
Thu, 29 Oct 2020 19:04:10 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"88dc985411e715a7"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 29 Oct 2021 19:04:10 GMT
css
fonts.googleapis.com/ Frame 8427
7 KB
824 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 30 Oct 2020 08:14:03 GMT
server
ESF
date
Fri, 30 Oct 2020 09:09:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 30 Oct 2020 09:09:36 GMT
css
fonts.googleapis.com/ Frame 8427
5 KB
738 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500&text=
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 30 Oct 2020 07:28:09 GMT
server
ESF
date
Fri, 30 Oct 2020 09:09:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 30 Oct 2020 09:09:36 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/376986709601508193/ Frame 8427
31 KB
31 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/376986709601508193/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qnL6JOlelJJm4uicf_nv-z8LPh91g
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec42ea8d25581e215f86f0c55fa4bb05aedefc53651ac99b313ea55ab1681690
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 07:19:46 GMT
x-content-type-options
nosniff
last-modified
Thu, 23 Jul 2020 16:02:16 GMT
server
sffe
age
6590
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31858
x-xss-protection
0
expires
Sat, 30 Oct 2021 07:19:46 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/12911913208147570117/ Frame 8427
16 KB
16 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/12911913208147570117/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qkh3i4E216tyjLe2U-4q4HLkMuZgQ
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be07dba3d4cb33e99bf83b1feac8cff1e63c1f55cf3ad9d153bba61ad49c3bee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 04:37:04 GMT
x-content-type-options
nosniff
last-modified
Fri, 31 Jul 2020 13:47:12 GMT
server
sffe
age
16352
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16273
x-xss-protection
0
expires
Sat, 30 Oct 2021 04:37:04 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 8427
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CpHAnT9ibX5mZEcScgQemj6m4DsmDmKZf2dKmp_0L2tkeEAEg0YfSIGCV-vCBjAegAbTYvv4DyAEGqQIBjV8tMZmzPuACAKgDAcgDCqoEoAJP0GtswOLO70xiRXcnp05TM97TvEKT5POCcITdvn75Ulx8luBKxYaR_EnYeR68ZkfnIW1IpuFG21V7nzFCXN6zfgXjliBgNloBvmnd78d9ldFVj1MG-_NjPuRsLGQ7IHEcZjQ2X6sOFACC9bSn3A54B25CJFJ9mPVva5lPSKUpU008mS2dlZ4_PYGLhsFPo35qrCjbajVTm1_9jdIZBqClmUei8UKdX3t_3tfdS5PsB7xzRi4ZrtUPkg-CFZWKhzbypVsZ7k8y-h_HQHukV25L98P14L861YzhIfQxUb2bFXTTvqQbLs8Zd8-SUzKccNOst1PpCQOoDo6pUuEWfZGca8_Pn7zbJCbTEmqLDHa-CUPXjwIN50xquoc7MzMZnJnABIeQldiRA-AEAZIFBAgEGAGSBQQIBRgEoAY3gAe0p8EBqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEEJmuMdIICQiA4YBAEAEYHfIIG2FkeC1zdWJzeW4tNzI2MzU3MzQ0NjgwNDA3OIAKA8gLAbIMFHB1Yi05Njg1NzM0NDQ1NDc2ODE0wgwCCAHYEw2IFAU&sigh=39o3APUVB4E&template_id=492&tpd=AGWhJmtg_tSWCSVeOpBHMjYlTf2KW6DBaO3qbUGfQrpFSoIsgw
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

l
www.google.com/ads/measurement/ Frame 8427
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRR5M1xECCNQIdIXSV9vcJ5ZvouL0t9_Dh-yYA3AivUerlpadnz23W9s0lUAeAYHTvefrVl
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8427
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 29 Oct 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
79238
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Fri, 30 Oct 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8427
295 B
388 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options
nosniff
server
cafe
age
38255
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 30 Oct 2020 22:32:01 GMT
truncated
/ Frame 8427
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8c346cf2094adbf54752ece0e3aedd14d288a998a5ca40f205ffc5ad69a86e1

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
444 KB
445 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=1429-456334

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
2763449
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5137-BWI, cache-fra19174-FRA
status
206
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 1429-456334/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1604048976.092545,VS0,VE0
access-control-allow-origin
*
Content-Length
454906
x-cache-hits
2, 2
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

status
200
retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Fri, 30 Oct 2020 09:09:36 GMT
x-served-by
cache-fra19174-FRA
x-cache
HIT
x-cache-hits
0
x-timer
S1604048976.075199,VS0,VE0
cache-control
max-age=31557600
content-length
0
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame D006
314 KB
109 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d1ce322bc9ea09a1464959be0b64d19797e4d946a1051a66cc3ca3fdbde8ade9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110925
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:36 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8427
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://threatpost.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 11:20:33 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
164943
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11016
x-xss-protection
0
expires
Thu, 28 Oct 2021 11:20:33 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8427
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://threatpost.com
Referer
https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 11:20:33 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:48 GMT
server
sffe
age
164943
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11056
x-xss-protection
0
expires
Thu, 28 Oct 2021 11:20:33 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame E622
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuUCTg40geKTVewK5ET6fqt9_Zh5TcqQni4iIZ2ndFvTN5pw3gKB_JkypjfqwqQ5egdCcd4wgHNgS35-67vVs97Ma0sHCrEGw5F7Jsas9QG2-VvtSAGl36AB3XKsGc7qUASzcIrKWnOnCjvaXfVIZoYZAd2qLuIguQDg70IMFsUb9Wz3x_dOERWTh3YS-mJk_1xIZ0uLN8WSKIHKF6mZyx7R23vbaB4MpfEdoERhpudGHh6G3mUqbIQwa6kDW7WoHtE8TzVHlwvqN3-9-pABw&sai=AMfl-YTURCfJPXLwj1d_lGMouuO2_eTGSwxDWrTIY4jUC4C7R3sQyQ_JibGXpKUfS2jI5VTX8zBOvRxDRYlov7PVfB4sTCnUfroBI0F0ObxIVEIN1A4g1AuCxBNEwfOur8BI&sig=Cg0ArKJSzGiMSIUO2sWWEAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:36 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame E622
0
21 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuVca9UNiFJ2FcMXTIwM284EeK_Z6PeQNYgN-ynGfxhXup0NhpBxcIYc2wXEjMa7mzzEXk8S6juCF44k7Vl6rlHfKWwD9-OyXiX9hgXPWN85zgKWWFPlek63v3qLHAYKoXEZ16iMNMtolUhirsoO-QSz4jhtwPqYLoZF72d7_RRkQpPp3wgvWacolRbiKH6-bdrOzy6X6JA6DUIVu0i6ntKTWr5WTAL0oTcyE1jMeTEVGRcJYEYqJkXZL6YbcZ5IboejQoQEfGGxn7gyO1lbhq6&sai=AMfl-YSJV04qlIOFkMwVl6Oz6E6QLE-dOIkzqcSiN5Xoq4RX47vuC2xh93KddUVIVzytg3j_S1v6xL6rmQgI3alyd-qdGawGEixtVaCUn2bGz9IprMg4sCJG5NRGu_1bou4H&sig=Cg0ArKJSzNip3wJEClgYEAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:36 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
truncated
/ Frame E622
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
206e71514db8be6abed77633193d202fa2227028c155c94af1edc33dcc97ddf4

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
bridge3.419.0_en.html
imasdk.googleapis.com/js/core/ Frame 7902
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.419.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
191237
date
Sat, 24 Oct 2020 03:25:24 GMT
expires
Sun, 24 Oct 2021 03:25:24 GMT
last-modified
Sat, 24 Oct 2020 03:17:21 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
539052
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame D006
26 KB
11 KB
Script
General
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10523
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:36 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 8427
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: threatpost.com
URL: https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Fri, 30 Oct 2020 09:09:36 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
downsize_200k_v1
tpc.googlesyndication.com/simgad/376986709601508193/ Frame 8427
31 KB
31 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/376986709601508193/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qnL6JOlelJJm4uicf_nv-z8LPh91g
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec42ea8d25581e215f86f0c55fa4bb05aedefc53651ac99b313ea55ab1681690
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 07:19:46 GMT
x-content-type-options
nosniff
last-modified
Thu, 23 Jul 2020 16:02:16 GMT
server
sffe
age
6590
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31858
x-xss-protection
0
expires
Sat, 30 Oct 2021 07:19:46 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/12911913208147570117/ Frame 8427
16 KB
16 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/12911913208147570117/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qkh3i4E216tyjLe2U-4q4HLkMuZgQ
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be07dba3d4cb33e99bf83b1feac8cff1e63c1f55cf3ad9d153bba61ad49c3bee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 04:37:04 GMT
x-content-type-options
nosniff
last-modified
Fri, 31 Jul 2020 13:47:12 GMT
server
sffe
age
16352
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16273
x-xss-protection
0
expires
Sat, 30 Oct 2021 04:37:04 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8427
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 29 Oct 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
79238
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Fri, 30 Oct 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8427
295 B
388 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options
nosniff
server
cafe
age
38255
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 30 Oct 2020 22:32:01 GMT
integrator.js
adservice.google.com/adsid/ Frame D006
109 B
810 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
sodar
pagead2.googlesyndication.com/getconfig/
8 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020102201&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102201.js?21068364
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
576c9669c40f0622894ec41c6880941ecc70e71f377d291c8022d56f77aa36c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6465
x-xss-protection
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame
0
0
Other
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol
H2
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
range
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

status
200
retry-after
0
access-control-allow-origin
*
access-control-allow-methods
*
access-control-allow-headers
range
accept-ranges
bytes
date
Fri, 30 Oct 2020 09:09:36 GMT
x-served-by
cache-fra19174-FRA
x-cache
HIT
x-cache-hits
0
x-timer
S1604048977.627336,VS0,VE0
cache-control
max-age=31557600
content-length
0
0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame D006
390 KB
390 KB
XHR
General
Full URL
https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=456335-855191

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
last-modified
Mon, 07 Sep 2020 18:49:41 GMT
age
2763450
etag
"7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by
cache-bwi5137-BWI, cache-fra19174-FRA
status
206
x-cache
HIT, HIT
content-type
video/mp4
Content-Range
bytes 456335-855191/32479190
cache-control
max-age=31557600
accept-ranges
bytes
x-timer
S1604048977.642605,VS0,VE0
access-control-allow-origin
*
Content-Length
398857
x-cache-hits
2, 3
sodar2.js
tpc.googlesyndication.com/sodar/
16 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1603823857801521"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6015
x-xss-protection
0
expires
Fri, 30 Oct 2020 09:09:36 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame 5A56
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/219/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4867
date
Fri, 30 Oct 2020 08:21:11 GMT
expires
Sat, 30 Oct 2021 08:21:11 GMT
last-modified
Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2905
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/
0
216 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020102201&jk=850469350768415&bg=!_P-l_9_NAAVp0lmVaVj7-1IeXiGClwIAAABOUgAAABEKAYy0Y5amVRlU-fulAnn58a4D8cMQUJVPlOdl4qHygfd3SU5T_aNCyh-DcAOqbQrcvBRfjrmHvXRN53EfcJyrNGSKvSCaYFGm4LH222Am6VtjpmEVt_wW9bTWz4vQZe6oznd_FLB1RPHFgScxjudfQjF_fowa-WIMA6W-7gPPLt6zOO3ml5g80zqyMU_MFWt7Mxu6WFOXMVITOrmyUzhteCx7fJGXIfRIKi5Ij9YGO6ZuAFCMWOwUZ3oQqEApST8RIxGYc7QwS5hCX7sbddORpLpEu3Q8nNxqJftWLrJmMN5_gmExpmiU-Lj3D8QiDgQ-1N8VA775B80p2Ysbx5oeUFC5gKE10jGmqymyeILytTHLiaJfVEAo3Vp5aiC5lPySr3bHgG_URd4bhsFJoJImGZslFy3yFpQNLCDR1KTX1PcQhAsx_mAUcVrTJk-zcbcIgSdR_sFM0_BVfe5F2pl1D43epY7A5t-WAzHQ3Egwrl8BY2noT9p48FlZYzdCJIpFI8mlAsJiWRK2xfFW7dmZAaf2Di-xImD47B3HYEdmVnjvhL3BvGoy7ljMDmFhhRsewTXIxVTZEQg0yeLrlhqU73Rd0lo0lsl0IVoFQbZrL1eHeDpjhf4OyO4q9i2fTQjSsIHzWoiU-SEipWa4kCEClXUdSgFMZTGPzr1dSAP_AoReA7cyMajZ-Zd-3zVeAlsCluj7MAExTQuIVGwOw1hjQLxV-jSKUc4kPvR6bFhBJ27pjcZM2abMIMEu9DgV1Nsgz_rfQqY0IOhfhdcubVo9fAKPJ5hJgc_5Pdja555nbT8UyhRg7KK9UTFTBmjot6qWpfcKfnRbGZx5M-0P8XEfxiVlxs-_ErLoYJex_GJiGHWm6Kn9AEUjmuwy8wtaxdSpL4nXq5DnDlVsyafEn8FgWfnnezi57Q3uR1C8lvuvlEgwB1saxXzORp0VqmRXbHOLa09erP-m4YNmviNEQ5LRGvylkJ8dZY3XP2HtFMipaNCi3JsZTleRMsRcjsfiiByDXsMIVtPJk5XHQRmCmTOXXXJQaIqdYGsOMVdnFe8gWdVRS_21CznHw4ZKdv2QEsDzXngzAO3A1Sk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:36 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mq
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/mq?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:36 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
bridge3.419.0_en.html
imasdk.googleapis.com/js/core/ Frame 62FE
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.419.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
191237
date
Sat, 24 Oct 2020 03:25:24 GMT
expires
Sun, 24 Oct 2021 03:25:24 GMT
last-modified
Sat, 24 Oct 2020 03:17:21 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
539052
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.419.0_en.html
imasdk.googleapis.com/js/core/ Frame B6C2
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.419.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
191237
date
Sat, 24 Oct 2020 03:25:24 GMT
expires
Sun, 24 Oct 2021 03:25:24 GMT
last-modified
Sat, 24 Oct 2020 03:17:21 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
539053
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.419.0_en.html
imasdk.googleapis.com/js/core/ Frame 570B
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.419.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
191237
date
Sat, 24 Oct 2020 03:25:24 GMT
expires
Sun, 24 Oct 2021 03:25:24 GMT
last-modified
Sat, 24 Oct 2020 03:17:21 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
539053
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.419.0_en.html
imasdk.googleapis.com/js/core/ Frame 8430
0
0
Document
General
Full URL
https://imasdk.googleapis.com/js/core/bridge3.419.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.419.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
191237
date
Sat, 24 Oct 2020 03:25:24 GMT
expires
Sun, 24 Oct 2021 03:25:24 GMT
last-modified
Sat, 24 Oct 2020 03:17:21 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
539053
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activeview
pagead2.googlesyndication.com/pcs/ Frame 8427
42 B
65 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuOa1suzoGV8jp8nHBDPoHfETrp8mA5XaeAmro0SZcVp8IyiF6HCSSCmyqobkvRIGDY_v1F7Iw9Cnhavnjy8qL4b6iKgaQrR5ioi5J-qPE0rL41JMs45pJhSVHu1G_CVWUWfqmBWbR7hdaq6qFkSXsA&sai=AMfl-YQc96QcNZBjF3g_P8HDx0-znrGjTzzDSIF2-GS-KpIWTVr-MXeLON1QwXQXIqtPiATx8PU127O2BhrcycoFUpiXBanFdWX0L-OaG1L3KMMYO8pbCgy3i6OmFfmLTJS3&sig=Cg0ArKJSzG7Bh1pTM9B0EAE&cid=CAASPeRoiuFRddQUcwBPvvCHjf7a7OTV8l0WS-dvIuC7fkmgPbwxjqXTg_WbMmfsigbb4cwpJYoDp9FgrGJgNyo&id=ampim&o=315,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,0,1001,1001&tos=0,0,0,1001,0&tfs=218&tls=1219&g=100&h=100&tt=1219&r=v&avms=ampa&adk=1015519800
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sv
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/sv?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:37 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kgw1cfgs&c=366920600669&slotId=183460300334.5&eee=missing-element&bi=missing-id&ulv=1
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
42
r4---sn-4g5ednse.c.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m...
Redirect Chain
  • https://gcdn.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
  • https://r4---sn-4g5ednse.c.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/acao,ctier,expire,id,ip,ipbits,i...
2 MB
2 MB
Media
General
Full URL
https://r4---sn-4g5ednse.c.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/154560E7251D92661BEAA3007CCD52AA37637B19.763531DD1A981077E82E3F5BC865B701C5744A45/key/cms1/cms_redirect/yes/mh/7w/mip/2a01:4f8:121:131a::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1604048908/mv/m/mvi/4/pl/42?cpn=Zeiu4IHc81iWLy9T&file=file.mp4
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:69::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
2f0e42a7a0d5b2d8ea5fe4c73bd5b93a01c9682e67585d46bed2414d8d3c8714
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 30 Oct 2020 09:09:38 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 24 Oct 2020 00:30:53 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/mp4
Content-Range
bytes 0-2058497/2058498
Cache-Control
private, max-age=86400
Connection
close
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
2058498
Expires
Fri, 30 Oct 2020 09:09:38 GMT

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:37 GMT
server
ClientMapServer
status
302
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
location
https://r4---sn-4g5ednse.c.2mdn.net/videoplayback/id/15aebdd4ccbec943/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3747206897/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/154560E7251D92661BEAA3007CCD52AA37637B19.763531DD1A981077E82E3F5BC865B701C5744A45/key/cms1/cms_redirect/yes/mh/7w/mip/2a01:4f8:121:131a::2/mm/42/mn/sn-4g5ednse/ms/onc/mt/1604048908/mv/m/mvi/4/pl/42?cpn=Zeiu4IHc81iWLy9T&file=file.mp4
cache-control
no-cache, must-revalidate
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
677
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~kgw1cgmf&c=366920600669&slotId=183460300334.5&ps=0x0&met.4=hvd_lc.kgw1cgmf~hvd_src.kgw1cgmf&umsem=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcd.connatix.com%252Fconnatix.player.js&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~kgw1cgos&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcapi.connatix.com%252Ftr%252Fe&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=4~kgw1cgos&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcapi.connatix.com%252Fcore%252Fpls%253Fv%253D71742&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=5~kgw1cgot&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcapi.connatix.com%252Ftr%252Fsr%253Fv%253D71742&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
54 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=6~kgw1cgot&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvid.connatix.com%252F54ab44ae-2675-4cee-bcea-ec4cd9d0180b%252F3_media.bin&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
339 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=7~kgw1cgot&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcapi.connatix.com%252Ftr%252Fao%253Fv%253D71742&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=8~kgw1cgou&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcds.connatix.com%252Fp%252Fplugins%252Fprebid3.25.0-1.js&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=9~kgw1cgou&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvid.connatix.com%252F54ab44ae-2675-4cee-bcea-ec4cd9d0180b%252Fplaylist.m3u8&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=a~kgw1cgou&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fads.adaptv.advertising.com%252Frtb%252Fopenrtb%253Fext_id%253DTeachingAidsLLC&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=b~kgw1cgov&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fib.adnxs.com%252Fut%252Fv3%252Fprebid&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=c~kgw1cgov&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fteachingaids-d.openx.net%252Fv%252F1.0%252Favjp%253Fju%253Dhttps%25253A%25252F%25252Fthreatpost.com%25252Frussian-espionage-custom-malware%25252F160673%25252F%25253Fweb_view%25253Dtrue%2526ch%253DUTF-8%2526res%253D1600x1200x24%2526ifr%253Dtrue%2526tz%253D-60%2526tws%253D1600x1200%2526be%253D1%2526bc%253Dhb_pb_3.0.2%2526dddid%253Dcde88694-b3be-4807-8b22-b31b39047d86%2526nocache%253D1604048975750%2526schain%253D1.0%25252C1!admetricspro.com%25252C1%25252C1%25252C%25252C%25252C%2526auid%253D540882778%2526vwd%253D400%2526vht%253D225&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=d~kgw1cgov&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fib.adnxs.com%252Fut%252Fv3%252Fprebid&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=e~kgw1cgov&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fas-sec.casalemedia.com%252Fcygnus%253Ft%253D900%2526s%253D435870%2526v%253D8.1%2526r%253D%25257B%252522id%252522%25253A%252522907121ad46dbf4%252522%25252C%252522imp%252522%25253A%25255B%25257B%252522id%252522%25253A%25252210b6ec25def7915%252522%25252C%252522ext%252522%25253A%25257B%252522siteID%252522%25253A%252522435870%252522%25252C%252522sid%252522%25253A%252522400x225%252522%25257D%25252C%252522bidfloor%252522%25253A0.25%25252C%252522bidfloorcur%252522%25253A%252522USD%252522%25252C%252522video%252522%25253A%25257B%252522mimes%252522%25253A%25255B%252522video%25252Fmp4%252522%25252C%252522video%25252Fwebm%252522%25252C%252522application%25252Fjavascript%252522%25252C%252522video%25252Fogg%252522%25252C%252522video%25252Fmpeg%252522%25255D%25252C%252522minduration%252522%25253A0%25252C%252522maxduration%252522%25253A180000%25252C%252522protocols%252522%25253A%25255B1%25252C2%25252C3%25252C4%25252C5%25252C6%25255D%25252C%252522w%252522%25253A400%25252C%252522h%252522%25253A225%25252C%252522placement%252522%25253A1%25257D%25257D%25255D%25252C%252522site%252522%25253A%25257B%252522page%252522%25253A%252522https%25253A%25252F%25252Fthreatpost.com%25252Frussian-espionage-custom-malware%25252F160673%25252F%25253Fweb_view%25253Dtrue%252522%25257D%25252C%252522ext%252522%25253A%25257B%252522source%252522%25253A%252522prebid%252522%25257D%25252C%252522source%252522%25253A%25257B%252522ext%252522%25253A%25257B%252522schain%252522%25253A%25257B%252522ver%252522%25253A%2525221.0%252522%25252C%252522complete%252522%25253A1%25252C%252522nodes%252522%25253A%25255B%25257B%252522asi%252522%25253A%252522admetricspro.com%252522%25252C%252522hp%252522%25253A1%25252C%252522sid%252522%25253A%2525221%252522%25257D%25255D%25257D%25257D%25257D%25257D%2526ac%253Dj%2526sd%253D1%2526nf%253D1&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=f~kgw1cgow&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fas-sec.casalemedia.com%252Fcygnus%253Ft%253D900%2526s%253D435871%2526v%253D8.1%2526r%253D%25257B%252522id%252522%25253A%252522112d58ca0d77f94%252522%25252C%252522imp%252522%25253A%25255B%25257B%252522id%252522%25253A%252522126e1718a29875a%252522%25252C%252522ext%252522%25253A%25257B%252522siteID%252522%25253A%252522435871%252522%25252C%252522sid%252522%25253A%252522400x225%252522%25257D%25252C%252522bidfloor%252522%25253A0.25%25252C%252522bidfloorcur%252522%25253A%252522USD%252522%25252C%252522video%252522%25253A%25257B%252522mimes%252522%25253A%25255B%252522video%25252Fmp4%252522%25252C%252522video%25252Fwebm%252522%25252C%252522application%25252Fjavascript%252522%25252C%252522video%25252Fogg%252522%25252C%252522video%25252Fmpeg%252522%25255D%25252C%252522minduration%252522%25253A0%25252C%252522maxduration%252522%25253A180000%25252C%252522protocols%252522%25253A%25255B1%25252C2%25252C3%25252C4%25252C5%25252C6%25255D%25252C%252522w%252522%25253A400%25252C%252522h%252522%25253A225%25252C%252522placement%252522%25253A1%25257D%25257D%25255D%25252C%252522site%252522%25253A%25257B%252522page%252522%25253A%252522https%25253A%25252F%25252Fthreatpost.com%25252Frussian-espionage-custom-malware%25252F160673%25252F%25253Fweb_view%25253Dtrue%252522%25257D%25252C%252522ext%252522%25253A%25257B%252522source%252522%25253A%252522prebid%252522%25257D%25252C%252522source%252522%25253A%25257B%252522ext%252522%25253A%25257B%252522schain%252522%25253A%25257B%252522ver%252522%25253A%2525221.0%252522%25252C%252522complete%252522%25253A1%25252C%252522nodes%252522%25253A%25255B%25257B%252522asi%252522%25253A%252522admetricspro.com%252522%25252C%252522hp%252522%25253A1%25252C%252522sid%252522%25253A%2525221%252522%25257D%25255D%25257D%25257D%25257D%25257D%2526ac%253Dj%2526sd%253D1%2526nf%253D1&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=g~kgw1cgow&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fteachingaids-d.openx.net%252Fv%252F1.0%252Favjp%253Fju%253Dhttps%25253A%25252F%25252Fthreatpost.com%25252Frussian-espionage-custom-malware%25252F160673%25252F%25253Fweb_view%25253Dtrue%2526ch%253DUTF-8%2526res%253D1600x1200x24%2526ifr%253Dtrue%2526tz%253D-60%2526tws%253D1600x1200%2526be%253D1%2526bc%253Dhb_pb_3.0.2%2526dddid%253D7942a1ee-06a4-4a4e-8d56-bbf9d834c748%2526nocache%253D1604048975759%2526schain%253D1.0%25252C1!admetricspro.com%25252C1%25252C1%25252C%25252C%25252C%2526auid%253D540882779%2526vwd%253D400%2526vht%253D225&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=h~kgw1cgow&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fhbopenbid.pubmatic.com%252Ftranslator%253Fsource%253Dprebid-client&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=i~kgw1cgox&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvid.connatix.com%252F54ab44ae-2675-4cee-bcea-ec4cd9d0180b%252F0.m3u8&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=j~kgw1cgox&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvid.connatix.com%252F54ab44ae-2675-4cee-bcea-ec4cd9d0180b%252F0.mp4&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=k~kgw1cgox&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fimasdk.googleapis.com%252Fjs%252Fsdkloader%252Fima3.js&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=l~kgw1cgoy&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fs0.2mdn.net%252Finstream%252Fvideo%252Fclient.js&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=m~kgw1cgoy&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvid.connatix.com%252F54ab44ae-2675-4cee-bcea-ec4cd9d0180b%252F0.mp4&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame D006
0
21 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=n~kgw1cgoy&c=366920600669&slotId=183460300334.5&ps=0x0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fcapi.connatix.com%252Ftr%252Fmq%253Fv%253D71742&encoded_body_size=0&transfer_size=0
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2800:3f0:4001:81b::2003 São Paulo, Brazil, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:39 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ai
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/ai?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:38 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/
2 KB
2 KB
Image
General
Full URL
https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:38 GMT
via
1.1 varnish, 1.1 varnish
age
3060393
x-cache
HIT, HIT
fastly-io-info
ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status
200
fastly-stats
io=1
content-encoding
gzip
content-length
2066
x-served-by
cache-dca17763-DCA, cache-fra19140-FRA
x-timer
S1604048978.161869,VS0,VE0
etag
"iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary
Accept
x-amz-request-id
9718C29D2B1AEC8D
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/webp
x-cache-hits
1, 2
ixmatch.html
js-sec.indexww.com/um/ Frame 6D07
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
js-sec.indexww.com
:scheme
https
:path
/um/ixmatch.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
Apache
last-modified
Tue, 06 Oct 2020 14:04:48 GMT
etag
"e20015-8f4-5b10114f2003a"
accept-ranges
bytes
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip
content-length
1136
date
Fri, 30 Oct 2020 09:09:38 GMT
showad.js
ads.pubmatic.com/AdServer/js/ Frame FBB2
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
X-Akamai-Path-Stats
[1:109:891]
Cache-Control
public, max-age=52706
Expires
Fri, 30 Oct 2020 23:48:04 GMT
Date
Fri, 30 Oct 2020 09:09:38 GMT
Connection
keep-alive
Vary
Accept-Encoding
showad.js
ads.pubmatic.com/AdServer/js/ Frame 7A41
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
X-Akamai-Path-Stats
[1:109:891]
Cache-Control
public, max-age=52706
Expires
Fri, 30 Oct 2020 23:48:04 GMT
Date
Fri, 30 Oct 2020 09:09:38 GMT
Connection
keep-alive
Vary
Accept-Encoding
pd
u.openx.net/w/1.0/ Frame 6475
Redirect Chain
  • https://u.openx.net/w/1.0/pd
  • https://u.openx.net/w/1.0/pd?cc=1
0
0
Document
General
Full URL
https://u.openx.net/w/1.0/pd?cc=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=383be694-371c-458f-a8eb-f1ad2fca45c5|1604048978
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=383be694-371c-458f-a8eb-f1ad2fca45c5|1604048978; Version=1; Expires=Sat, 30-Oct-2021 09:09:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604048978|gekin0vNiygu; Version=1; Expires=Sat, 14-Nov-2020 09:09:38 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.196.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Fri, 30 Oct 2020 09:09:38 GMT
content-type
text/html
content-length
420
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=383be694-371c-458f-a8eb-f1ad2fca45c5|1604048978; Version=1; Expires=Sat, 30-Oct-2021 09:09:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.196.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1
date
Fri, 30 Oct 2020 09:09:38 GMT
content-length
0
via
1.1 google
alt-svc
clear
ixmatch.html
js-sec.indexww.com/um/ Frame B5A0
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
js-sec.indexww.com
:scheme
https
:path
/um/ixmatch.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
Apache
last-modified
Tue, 06 Oct 2020 14:04:48 GMT
etag
"e20015-8f4-5b10114f2003a"
accept-ranges
bytes
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip
content-length
1136
date
Fri, 30 Oct 2020 09:09:38 GMT
pd
u.openx.net/w/1.0/ Frame 0233
Redirect Chain
  • https://u.openx.net/w/1.0/pd
  • https://u.openx.net/w/1.0/pd?cc=1
0
0
Document
General
Full URL
https://u.openx.net/w/1.0/pd?cc=1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash

Request headers

:method
GET
:authority
u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=1807e845-666a-4792-be62-f293cfa457c5|1604048978
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=1807e845-666a-4792-be62-f293cfa457c5|1604048978; Version=1; Expires=Sat, 30-Oct-2021 09:09:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604048978|gekin0vNiygu; Version=1; Expires=Sat, 14-Nov-2020 09:09:38 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.196.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Fri, 30 Oct 2020 09:09:38 GMT
content-type
text/html
content-length
415
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=1807e845-666a-4792-be62-f293cfa457c5|1604048978; Version=1; Expires=Sat, 30-Oct-2021 09:09:38 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.196.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://u.openx.net/w/1.0/pd?cc=1
date
Fri, 30 Oct 2020 09:09:38 GMT
content-length
0
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/dmp/ Frame FCA0
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
X-Akamai-Path-Stats
[1:356:4294966940]
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Sat, 31 Oct 2020 09:09:40 GMT
Date
Fri, 30 Oct 2020 09:09:38 GMT
Connection
keep-alive
async_usersync.html
acdn.adnxs.com/dmp/ Frame E378
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
X-Akamai-Path-Stats
[1:356:4294966940]
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Sat, 31 Oct 2020 09:09:40 GMT
Date
Fri, 30 Oct 2020 09:09:38 GMT
Connection
keep-alive
%7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame D006
43 B
839 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 30 Oct 2020 09:09:38 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
status
200
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ups.analytics.yahoo.com/ups/55986/ Frame D006
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
  • https://pixel.advertising.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS
  • https://pixel.advertising.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&verify=true
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&apid=UPa3743796-1a8f-11eb-9e9e-020b4f9b4944
0
963 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&apid=UPa3743796-1a8f-11eb-9e9e-020b4f9b4944
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS/7.1.2.113 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 30 Oct 2020 09:09:39 GMT
Server
ATS/7.1.2.113
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status
302
date
Fri, 30 Oct 2020 09:09:39 GMT
location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5vYUgAAAJm49VLS&_origin=0&gdpr=0&gdpr_consent=&_test=X5vYUgAAAJm49VLS&apid=UPa3743796-1a8f-11eb-9e9e-020b4f9b4944
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
pixel.advertising.com/ups/55953/ Frame D006
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://pixel.advertising.com/ups/55953/sync?uid=7162485d-ca74-42b6-9eb5-544fed20a4db&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=7162485d-ca74-42b6-9eb5-544fed20a4db
0
124 B
Image
General
Full URL
https://pixel.advertising.com/ups/55953/sync?uid=7162485d-ca74-42b6-9eb5-544fed20a4db&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=7162485d-ca74-42b6-9eb5-544fed20a4db
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.102.119 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:39 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:38 GMT
x-aspnet-version
4.0.30319
status
302
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.advertising.com/ups/55953/sync?uid=7162485d-ca74-42b6-9eb5-544fed20a4db&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=7162485d-ca74-42b6-9eb5-544fed20a4db
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
369
sync
ups.analytics.yahoo.com/ups/57304/ Frame D006
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&apid=UPa391f82a-1a8f-11eb-89ae-0225ad2058c0
0
963 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&apid=UPa391f82a-1a8f-11eb-89ae-0225ad2058c0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
18.156.0.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS/7.1.2.113 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Fri, 30 Oct 2020 09:09:39 GMT
Server
ATS/7.1.2.113
Connection
keep-alive
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status
302
date
Fri, 30 Oct 2020 09:09:39 GMT
location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFoQraPlr8zyI1g7K9pt-Oc&google_cver=1&apid=UPa391f82a-1a8f-11eb-89ae-0225ad2058c0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
av
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/av?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:40 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
ixmatch.html
js-sec.indexww.com/um/ Frame FE11
0
0
Document
General
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-135.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
js-sec.indexww.com
:scheme
https
:path
/um/ixmatch.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
server
Apache
last-modified
Tue, 06 Oct 2020 14:04:48 GMT
etag
"e20015-8f4-5b10114f2003a"
accept-ranges
bytes
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip
content-length
1136
date
Fri, 30 Oct 2020 09:09:40 GMT
sync
eb2.3lift.com/ Frame ADC1
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
0
0
Document
General
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.157.239.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
eb2.3lift.com
:scheme
https
:path
/sync?&ld=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
tluid=1697877081574451933
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
date
Fri, 30 Oct 2020 09:09:40 GMT
content-type
text/html; charset=utf-8
content-length
496
set-cookie
sync=CgoIgQIQvpKUxtcuCgoIoQEQvpKUxtcuCgoI4gEQvpKUxtcuCgoI5gEQvpKUxtcuCgoIhwIQvpKUxtcuCgkIORC-kpTG1y4KCQg6EL6SlMbXLgoJCAsQvpKUxtcuCgkIXxC-kpTG1y4KCQgfEL6SlMbXLg==; Max-Age=7776000; Expires=Thu, 28 Jan 2021 09:09:40 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=1697877081574451933; Max-Age=7776000; Expires=Thu, 28 Jan 2021 09:09:40 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

status
302
date
Fri, 30 Oct 2020 09:09:40 GMT
content-length
0
set-cookie
tluid=1697877081574451933; Max-Age=7776000; Expires=Thu, 28 Jan 2021 09:09:40 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync.html
public.servenobid.com/ Frame 35F7
0
0
Document
General
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
public.servenobid.com
:scheme
https
:path
/sync.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Tue, 27 Oct 2020 00:12:31 GMT
accept-ranges
bytes
etag
"834d0054029be21b49b8bf287a72afac"
server
AmazonS3
x-cache
TCP_HIT
x-amz-id-2
xUMQcJ/0hriDGiAFYpmFIQbGwEJMTxHKa0o0rbfuVVntivHRPISbpg5IM74ecrdkLKIj7JHoWy8=
x-amz-request-id
6DC15474778C7770
x-azure-ref-originshield
0nVubXwAAAABNLBSvrOJsRKnQGQNYORVhTE9OMjFFREdFMDIwNgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref
0VNibXwAAAACdx9hIduynTLftgD4qR5UjQlJVMzBFREdFMDQxNgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date
Fri, 30 Oct 2020 09:09:39 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame CD6B
0
0
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-51.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

Last-Modified
Tue, 24 Mar 2020 15:52:19 GMT
ETag
"5e7a2cb3-cefd"
X-Akamai-Path-Stats
[1:356:4294966940]
Server
nginx/1.13.10
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
17037
Cache-Control
max-age=86402
Expires
Sat, 31 Oct 2020 09:09:42 GMT
Date
Fri, 30 Oct 2020 09:09:40 GMT
Connection
keep-alive
usync.html
eus.rubiconproject.com/ Frame 1FE5
0
0
Document
General
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Mon, 28 Sep 2020 17:02:39 GMT
ETag
"4000c-123-5b062a240e9c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
238
Content-Type
text/html; charset=UTF-8
Date
Fri, 30 Oct 2020 09:09:40 GMT
Connection
keep-alive
Vary
Accept-Encoding
showad.js
ads.pubmatic.com/AdServer/js/ Frame EE51
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-68.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KTPCACOOKIE=YES; KCCH=YES; pi=156858:2; KADUSERCOOKIE=B0C602BA-E95D-4924-A272-EA01C73D79C6; chkChromeAb67Sec=1; DPSync3=1605225600%3A201_197_219%7C1604102400%3A174; SyncRTB3=1605312000%3A35%7C1605225600%3A220_21_13_56_161; PUBMDCID=3; KRTBCOOKIE_80=16514-CAESEHdzjLN3dCJcD917lhssVag&KRTB&22987-CAESEHdzjLN3dCJcD917lhssVag&KRTB&23025-CAESEHdzjLN3dCJcD917lhssVag; KRTBCOOKIE_391=22924-6301563531152467333; SPugT=1604048979; KRTBCOOKIE_336=5844-5738799438159336249; PugT=1604048979
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

Last-Modified
Wed, 21 Oct 2020 18:57:52 GMT
ETag
"13006b6-94f8-5b232eca8cf5e"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
X-Akamai-Path-Stats
[1:109:891]
Cache-Control
public, max-age=52704
Expires
Fri, 30 Oct 2020 23:48:04 GMT
Date
Fri, 30 Oct 2020 09:09:40 GMT
Connection
keep-alive
Vary
Accept-Encoding
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 83B9
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
0
0
Document
General
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Host
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

Date
Fri, 30 Oct 2020 09:09:41 GMT
Connection
Keep-Alive
Cache-Control
max-age=31603
Content-Length
4947
Content-Type
text/html
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges
bytes
ETag
"1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id
tx0000000000000003d491d-005f9b0248-4088601-nyc3a
Strict-Transport-Security
max-age=15552000; includeSubDomains; preload
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1604048981.dop204.pa1.t,1604048981.cds026.pa1.shn,1604048981.dop204.pa1.t,1604048981.cds204.pa1.c

Redirect headers

status
302
content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control
no-cache
Cookie set beacon
ap.lijit.com/ Frame 97B4
Redirect Chain
  • https://ap.lijit.com/beacon?informer=13394437
  • https://ap.lijit.com/beacon?informer=13394437&dnr=1
0
0
Document
General
Full URL
https://ap.lijit.com/beacon?informer=13394437&dnr=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Host
ap.lijit.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
ljt_reader=58b45d0a690b97b4b793acfb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

Server
nginx
Date
Fri, 30 Oct 2020 09:09:40 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Vary
Accept-Encoding
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Set-Cookie
ljtrtbexp=eJxljzsOgDAMQ%2B%2FSmaH5J1wNcXdE6RIzPsl5dq5B4ySfSmKS8xi80NjSXnTvLB2DOtPsXFUGCSiIr0DdJPZF%2FBwJDhiV0JqwMhUYNiX4GO9hEe%2FNs5gWR%2F9BwKfg0%2BpskLf27%2F0Aj%2BpSSg%3D%3D;Path=/;Domain=.lijit.com;Expires=Sat, 30-Oct-2021 09:09:40 GMT;Max-Age=31536000;Secure;SameSite=None ljt_reader=58b45d0a690b97b4b793acfb;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
Content-Encoding
gzip
X-Sovrn-Pod
ad_ap6ams1

Redirect headers

Server
nginx
Date
Fri, 30 Oct 2020 09:09:40 GMT
Content-Length
0
Set-Cookie
ljt_reader=58b45d0a690b97b4b793acfb;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ap.lijit.com/beacon?informer=13394437&dnr=1
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap6ams1
pd
eu-u.openx.net/w/1.0/ Frame 5FCE
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.196.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
pd=v2|1604048978|gekin0vNiygu; i=1807e845-666a-4792-be62-f293cfa457c5|1604048978
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=1807e845-666a-4792-be62-f293cfa457c5|1604048978; Version=1; Expires=Sat, 30-Oct-2021 09:09:40 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604048978.2|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Sat, 14-Nov-2020 09:09:40 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.196.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Fri, 30 Oct 2020 09:09:40 GMT
content-type
text/html
content-length
317
content-encoding
gzip
via
1.1 google
alt-svc
clear
generic
match.adsrvr.org/track/cmf/
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.161.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status
200
cache-control
private,no-cache, must-revalidate
content-type
image/gif
content-length
70
setuid
prebid.a-mo.net/
Redirect Chain
  • https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dindex_rtb%26uid%3D
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=index_rtb&uid=X5vYUnq1gythG0wadm3aTAAA%261177
0
141 B
Image
General
Full URL
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=index_rtb&uid=X5vYUnq1gythG0wadm3aTAAA%261177
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:39 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
2
server
envoy

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
server
Apache
status
302
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=index_rtb&uid=X5vYUnq1gythG0wadm3aTAAA%261177
cache-control
max-age=0, no-cache, no-store
content-type
text/html; charset=iso-8859-1
content-length
321
expires
Fri, 30 Oct 2020 09:09:40 GMT
setuid
prebid.a-mo.net/
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=sovrn&uid=defffb5f9ca5f4c360e194d3
0
138 B
Image
General
Full URL
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=sovrn&uid=defffb5f9ca5f4c360e194d3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:40 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
2
server
envoy

Redirect headers

Date
Fri, 30 Oct 2020 09:09:40 GMT
Server
nginx
Location
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=sovrn&uid=defffb5f9ca5f4c360e194d3
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap6ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
/
c1.adform.net/serving/cookie/match/
0
187 B
Image
General
Full URL
https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
server
nginx
status
403
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
expires
-1
sync
pixel.advertising.com/ups/55946/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUFhMTAxMGRiNC0xYThmLTExZWItYmIzZi0xMjc0YzFmZTViZjY%3D&gdpr=1&gdpr_consent=&_origin=0
  • https://pixel.advertising.com/ups/55946/sync?uid=CAESEJiORCawQcNHaEaA5VLHFv4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
0
124 B
Image
General
Full URL
https://pixel.advertising.com/ups/55946/sync?uid=CAESEJiORCawQcNHaEaA5VLHFv4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.102.119 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:40 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.advertising.com/ups/55946/sync?uid=CAESEJiORCawQcNHaEaA5VLHFv4&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
334
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
pixel.advertising.com/ups/56465/
0
124 B
Image
General
Full URL
https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.102.119 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:40 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
setuid
prebid.a-mo.net/
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=appnexus&uid=5547137768173640945
0
117 B
Image
General
Full URL
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=appnexus&uid=5547137768173640945
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:39 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
3
server
envoy

Redirect headers

Pragma
no-cache
Date
Fri, 30 Oct 2020 09:09:40 GMT
X-Proxy-Origin
89.249.64.171; 89.249.64.171; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.71:80
AN-X-Request-Uuid
b116881e-1d24-4836-9ee5-0511fbea69a3
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=appnexus&uid=5547137768173640945
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
current
aol-match.dotomi.com/match/bounce/
0
104 B
Image
General
Full URL
https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1Aa1010db4-1a8f-11eb-bb3f-1274c1fe5bf6&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1370 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
setuid
prebid.a-mo.net/
Redirect Chain
  • https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=false&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D1f7c72aa-37e6-4a70-8788-a0a12f62a31b%2...
  • https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=smartadserver&uid=2222315949382742527
0
123 B
Image
General
Full URL
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=smartadserver&uid=2222315949382742527
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:39 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
3
server
envoy

Redirect headers

location
https://prebid.a-mo.net/setuid?A=1f7c72aa-37e6-4a70-8788-a0a12f62a31b&D=&bidder=smartadserver&uid=2222315949382742527
date
Fri, 30 Oct 2020 09:09:39 GMT
content-length
0
sync
pixel.advertising.com/ups/55965/
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
  • https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=dTgqjCRmJtxtOnbWdzg-3HJrct9taiuLdDz-s75D
0
124 B
Image
General
Full URL
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=dTgqjCRmJtxtOnbWdzg-3HJrct9taiuLdDz-s75D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.59.102.119 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Fri, 30 Oct 2020 09:09:40 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Fri, 30 Oct 2020 09:09:40 GMT
status
302
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=dTgqjCRmJtxtOnbWdzg-3HJrct9taiuLdDz-s75D
cache-control
private, no-cache, no-store, proxy-revalidate
strict-transport-security
max-age=86400
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
abt
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/abt?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:40 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
aq
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/aq?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:41 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
st
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/st?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:42 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
aq
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/aq?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:45 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
aq
capi.connatix.com/tr/ Frame D006
0
323 B
XHR
General
Full URL
https://capi.connatix.com/tr/aq?v=71742
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Fri, 30 Oct 2020 09:09:49 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20

Verdicts & Comments Add Verdict or Comment

302 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes string| gAMP_urlhost string| gAMP_urlpath string| gAMP_urlquery string| gAMP_contentid string| gAMP_category string| gAMP_contenttags object| qxPY7a function| qxPY7b object| xop number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad728x90ATF object| ad300x250ATF object| ad300x250ATF2 object| ad728x90ATFTAB object| ad728x90STICKY object| ad300x250ATFTAB object| ad300x250ATF2TAB object| ad320x50ATF object| ad300x250ATFM object| ad300x250ATF2M object| ad2x2skin number| gBrowserWidth object| desktopAdUnits object| tabletAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount object| OX_dfp_ads number| minWidth boolean| disableBids object| googletag object| ggeac object| google_js_reporting_queue function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| __uspapi function| __uspOpenUI function| pbjsChunk object| pbjs object| _pbjsGlobals string| nobidVersion object| nobid object| _0x5518 function| _0x361a function| _0x16f8fc object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gOpenXBidsBack boolean| gPrebidBidsBack boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| customOxTargeting function| openXRefreshCallback function| sendAdserverRequest function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| configureAdSlot function| getCookie object| apstag function| cnx undefined| $ function| jQuery object| gdprDynamicStrings object| kss object| gdprStrings object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| sNew object| s0 object| dataLayer object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| cnx_usr_storage object| d7HM8a function| d7HM8b function| xblacklist object| GP2pza function| GP2pzb function| xblocker object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _qevents function| twq boolean| apstagLOADED object| recaptcha object| gaplugins object| gaGlobal object| gaData function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| twttr object| gf_global object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format object| gform undefined| __gf_keyup_timeout function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| gfMultiFileUploader undefined| __gf_timeout_handle function| gf_apply_rules function| gf_check_field_rule function| gf_get_field_logic function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default function| gf_is_hidden_pricing_input object| Placeholders object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| wp object| jQuery112408572938176011355 object| gf_form_conditional_logic string| gf_number_format function| do_callback object| closure_lm_793003 object| player_instance_cbef1604048975332 function| jQuery112408572938176011355_1604048974460 object| closure_lm_641119 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval boolean| DFPSFMessageEnabled object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager number| google_global_correlator object| closure_lm_403330 object| GoogleGcLKhOms object| google_image_requests function| cnxAddEventListener

8 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: DSID
Value: NO_DATA
.doubleclick.net/ Name: IDE
Value: AHWqTUkps5Ihk5pm6lg-ipOPTW6zWktAoNZmL_QXqVvbZf9WUF04JP1Zxzu-Y-Xb
threatpost.com/ Name: usprivacy
Value: 1---
.threatpost.com/ Name: __qca
Value: P0-1536739957-1604048975098
.threatpost.com/ Name: _ga
Value: GA1.2.2127540100.1604048975
.threatpost.com/ Name: _gid
Value: GA1.2.1168307160.1604048975
.threatpost.com/ Name: _gat_UA-35676203-21
Value: 1
.threatpost.com/ Name: __gads
Value: ID=af2577766295a1f8-22f8e3421ab9003f:T=1604048975:S=ALNI_MYXQbyEZfq0IMphhVxabflIVD_-mA

59 Console Messages

Source Level URL
Text
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372)
Message:
gBrowserWidth =1600
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api log URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397)
Message:
OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
%cCMP: Startup v270 color: #555599
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: uspapi_init() - v0.105
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
USP: Locale=en-us gdpr= false
console-api warning URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
ENGINE: final pbjs config
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
Initial Ad Load
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
%cCMP: GVL version is 45 color: #555599
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
__uspLaunch begin
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: checking non TCF vendor cookie
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: No existing non-TCF consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: Locale=en-us gdpr= false
console-api log URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27)
Message:
CMP: GDPR does not apply
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
Amazon bids returned, count=4
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs bids returned
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
gPBJSTimeoutTimer cleared
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest(): pbjsBidsBack
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest()
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
pbjs.getBidResponses:
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
gThisRefreshSlots=
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api log URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5)
Message:
console.groupEnd
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: No existing consent found in cookie, local or session storage
console-api warning URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3)
Message:
fun-hooks: referenced 'registerAdserver' but it was never created
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: geo IP found region Berlin
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: USP does not apply to Berlin
console-api log URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8)
Message:
uspapi: Setting not applicable signal
console-api info URL: https://cdn.ampproject.org/rtv/012010200130000/amp4ads-v0.js(Line 416)
Message:
Powered by AMP ⚡ HTML – Version 2010200130000 https://threatpost.com/russian-espionage-custom-malware/160673/?web_view=true
console-api log (Line 7)
Message:
CNX-ad-imp

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9412eced4d1262cdcc88d858edf8d6f2.safeframe.googlesyndication.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
csi.gstatic.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
imasdk.googleapis.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
r4---sn-4g5ednse.c.2mdn.net
rules.quantcount.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssbsync-global.smartadserver.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
104.111.215.135
104.111.215.51
104.111.215.68
104.111.230.142
104.244.42.131
104.244.42.133
134.209.129.254
136.144.59.88
151.101.112.157
151.101.114.137
151.101.114.49
151.101.14.137
172.217.21.226
172.217.22.66
18.156.0.31
18.157.239.120
18.221.6.219
185.33.220.244
185.64.189.112
185.86.139.104
199.232.53.140
205.185.216.10
206.189.254.17
216.52.2.30
2600:9000:20d7:7e00:2:9275:3d40:93a1
2600:9000:20d7:ac00:6:44e3:f8c0:93a1
2600:9000:20d7:da00:0:5c46:4f40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e0::ac40:631c
2620:116:800d:21:51e4:db4b:4436:b305
2620:1ec:21::14
2620:1ec:bdf::10
2800:3f0:4001:81b::2003
2a00:1288:110:c305::8000
2a00:1450:4001:69::9
2a00:1450:4001:800::2001
2a00:1450:4001:801::2003
2a00:1450:4001:806::200e
2a00:1450:4001:80b::2008
2a00:1450:4001:814::2001
2a00:1450:4001:815::2003
2a00:1450:4001:816::200e
2a00:1450:4001:817::2004
2a00:1450:4001:818::2002
2a00:1450:4001:81e::200a
2a00:1450:4001:81f::2003
2a00:1450:4001:820::200a
2a00:1450:4001:825::2002
2a00:1450:4001:825::2006
2a00:1450:400c:c07::9d
2a00:1450:400c:c0c::84
2a02:fa8:8806:12::1370
2a03:2880:f01c:800e:face:b00c:0:2
3.120.64.232
35.173.160.135
35.244.159.8
37.157.6.252
52.18.161.147
52.210.177.43
52.29.134.97
52.59.102.119
64.140.160.2
65.9.24.128
69.173.144.143
99.86.2.127
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06379eb7b2cef3b07276dcc5698f1039361c8480fe6ec49d55fc4f45d8664703
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0b53158fac1f17ebd5a4939bd127529b81b44c261bbf65506b151ccae4071617
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
116b7304c277667fe89b184f01d7ab13b8f81fb3378d21fc8b38c7f927f25d7b
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
206e71514db8be6abed77633193d202fa2227028c155c94af1edc33dcc97ddf4
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
2314dedd26d85f0f25afce54a05894a3eebee121d15f238fef733b6c89c386ed
2424c11ee5a708cfe8778891fbe7d95729e12d8a27b404851d099d7bde799563
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2f0e42a7a0d5b2d8ea5fe4c73bd5b93a01c9682e67585d46bed2414d8d3c8714
2f4dc58ccb9912a2f007bd9f09b089a9aa9fedec3064571def6330de4b486e7a
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
34d9891a81b9b276febf3b6f763ededd97fc364bd399e9446f71159be6cb1d0c
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
38bad52d2af003ec2a5f2fc2d6b37ba261e5cb8454ab3c84dffb0f95ca58ed3d
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
404fc0019db1f038122d963cd29abeee0da03bb1c637d9fd8dcfcbb979105fc7
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
426b6106cfafebd9ac03053cb06b441aed47c5df3956ad9a69260981db92779c
4473451078db552a3e4c47e578a385fee86f57ba923d26d0516e2231a81e2a9e
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4653687f2f0571ecaf6723d7743f92edf52159c03a8181763cb73031ad8a64bf
474150367e119d36f2aea719a965c2a4452efa8629e60b2b58311e98006d5e20
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4cdedf70376efbcabd5b556cac4ca0da0324bee9e46080b134ba160c74c0da83
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
517bca3d715aa94d9cb53024c0b2f5142ff43bc84b6444c703d7266f28766846
51b80b713d82dafe9d86ff2b83dd557f60cbf887ac76483df35a75e6479b59c5
576c9669c40f0622894ec41c6880941ecc70e71f377d291c8022d56f77aa36c6
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c
6a3107b93f81663eb7023a8d8bd8315f9a68c0d7c3e4fdd937f25ef320ed2502
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
6dbec1fc31acffd0443fc8e36d9ad0f5a3dd366d06fbdab024da0b61dcee1557
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
7d8865bb32d3ba618981090df05f9de09607c1f65764a7434016926de0a8fbcd
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7fad67a2de7d18ad1ceb6151c78c279dab655f6ca96138ef97ed470333e3c237
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
8639ccb4c80fb575ad9afdeafaede459d551abe55ba849c601fac618f8b7b8a9
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
87edde1bfc1e770086806bbe02ad8eee3d40f76a82b55ef81497d3d1dda51a89
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
960d6f50ac3a8e11b5ab68b5a561e0b330a5a9faec638023b9c8d3f1a4465711
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
9c4740903ba9c8accf0a82a96c4553065510bc6b1a486715c2cfd79b8cfd3f6c
9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186
9ccb61031667dbac3cdba7043e98c6db961e044679dc28b81eb11031dd4ce45f
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
a063d9b8cf1ec434b4aadd6d0686bbcab230fc03a193a8bcc97610c92d249538
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
ba94eaf90519494de4ee847524ee2d3567f8518dbd66dcb0a5f610cee321976d
be07dba3d4cb33e99bf83b1feac8cff1e63c1f55cf3ad9d153bba61ad49c3bee
bfcd5cce51aa77a183d418b0848ed62e532f99e5c4943934298593eb7acd284b
c2206501c5a898123871431da1a1ff12bcaf46194db997e6c9237296d9859daa
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
c6754451b2b215e37d3c1e147e7251a6da89a894591dc77581e061fed72e61fa
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a
c799c0a055898234d3692565188b828d2d41b3056cf5bbd2584e729968829b72
c7c1996ebe232df78acbe75e7967a34273c32debbb9f72cb9662bb86e205e718
c918c3596295070bd9409d3167161fa8ad072a46512875abf68088fb29d23fa7
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cceafb3cf0f7c5d834899998b9075ae162e2dafa356a0cbb0200b1597be30871
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d1ce322bc9ea09a1464959be0b64d19797e4d946a1051a66cc3ca3fdbde8ade9
d1e739b271e6bb6861bc19eeb0f50dd805a5e7e0672fe5a63a364edff3749637
d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d8c346cf2094adbf54752ece0e3aedd14d288a998a5ca40f205ffc5ad69a86e1
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e158f62efbcbccd3ee08139ff2fe754284bb67739c11b3394f7cda32457acf41
e2cf14e06244158f420cb73a4d75aa85c60020fd4701c0bb5ea726226c2214b3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e5c41077aafced98067ed5bad36d0518235b45963f432237d11d8b89c8d00873
e81f159ba3c6c18a88e66ecc621ddefedf80ac94a503eeaa77e5312bef71b9fc
e8347b75be6fd8c8526f52623bf351ff37e10b34e1f93f243d5e80adeffb36c8
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b
ec42ea8d25581e215f86f0c55fa4bb05aedefc53651ac99b313ea55ab1681690
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ed976fa6d67aa0878873ebbede82de4734c75c18688f61b996d30580f6691a07
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f56910ebecad8f317e57e178a0503f7d49c3d44ffe8f7ed3a23ffaa4d452aed7
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
fc20c0234d0486ba6024b34827382aa1f2193bf95005925a3eb3f85eedb31e29